@open-mercato/core 0.6.7-develop.6661.1.0043ed1d03 → 0.6.7-develop.6669.1.40b669666b

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3504 entry points
+[build:core] found 3507 entry points
 [build:core] built successfully
 [build:core:generated] found 188 entry points
 [build:core:generated] built successfully

package/dist/modules/customer_accounts/migrations/Migration20260724120000_customer_accounts.js

@@ -0,0 +1,56 @@
+import { Migration } from "@mikro-orm/migrations";
+function buildRepairPoisonedCustomerEntityLinksSql() {
+  return `do $$
+begin
+  if to_regclass('customer_entities') is null or to_regclass('customer_people') is null then
+    return;
+  end if;
+
+  update "customer_users" cu
+     set "customer_entity_id" = (
+           select company."id"
+             from "customer_entities" person
+             join "customer_people" profile
+               on profile."entity_id" = person."id"
+              and profile."tenant_id" = person."tenant_id"
+              and profile."organization_id" = person."organization_id"
+             join "customer_entities" company
+               on company."id" = profile."company_entity_id"
+              and company."tenant_id" = person."tenant_id"
+              and company."organization_id" = person."organization_id"
+              and company."kind" = 'company'
+              and company."deleted_at" is null
+            where person."id" = cu."customer_entity_id"
+              and person."tenant_id" = cu."tenant_id"
+              and person."organization_id" = cu."organization_id"
+              and person."kind" = 'person'
+              and person."deleted_at" is null
+            order by profile."created_at", profile."id"
+            limit 1
+         ),
+         "updated_at" = now()
+   where cu."customer_entity_id" is not null
+     and not exists (
+           select 1
+             from "customer_entities" company
+            where company."id" = cu."customer_entity_id"
+              and company."tenant_id" = cu."tenant_id"
+              and company."organization_id" = cu."organization_id"
+              and company."kind" = 'company'
+              and company."deleted_at" is null
+         );
+end
+$$;`;
+}
+class Migration20260724120000_customer_accounts extends Migration {
+  up() {
+    this.addSql(buildRepairPoisonedCustomerEntityLinksSql());
+  }
+  down() {
+  }
+}
+export {
+  Migration20260724120000_customer_accounts,
+  buildRepairPoisonedCustomerEntityLinksSql
+};
+//# sourceMappingURL=Migration20260724120000_customer_accounts.js.map

package/dist/modules/customer_accounts/migrations/Migration20260724120000_customer_accounts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/migrations/Migration20260724120000_customer_accounts.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\n/**\n * Builds the one-off repair for `customer_users.customer_entity_id` (#4473).\n *\n * `customerEntityId` is the CRM *company* FK and the portal company scope key \u2014\n * the portal Users page, portal invitations, and the company detail \"Portal\n * users\" group all filter on it. Earlier invite flows (#4362) could store a\n * person entity id, or an entity from another organization, in that column.\n * The `autoLinkCrm` subscriber normalizes it (#4457), but it only runs on\n * `customer_accounts.user.created`, which is never re-emitted for a row that\n * already exists \u2014 so users created before that fix keep the bad FK forever.\n * They stay scoped to the wrong company and every admin edit that resubmits the\n * pre-filled value fails with \"Company not found\".\n *\n * The repair mirrors the subscriber's normalization exactly: touch only rows\n * whose FK does NOT resolve to an in-org, non-deleted `company` entity, and for\n * those either recover the real company from the person's profile (when the FK\n * points at an in-org person whose company is itself in-org) or clear it.\n *\n * `updated_at` is bumped on every repaired row on purpose: it is the optimistic\n * lock version. Without the bump a client holding the pre-repair version could\n * resubmit the poisoned value and silently undo the fix instead of getting a\n * 409 conflict.\n *\n * The whole statement is wrapped in a `to_regclass` guard because the `customers`\n * tables it reads belong to a different module. `dbMigrate` walks enabled modules\n * in alphabetical order, so `customer_accounts` migrations run BEFORE `customers`\n * ones \u2014 on a fresh database these tables do not exist yet. A database in that\n * state has no poisoned rows to repair either, so skipping is the correct no-op.\n * `catalog/Migration20251116191744` already ships the same guarded `do $$` idiom.\n *\n * This SQL is hand-written rather than produced by `yarn db:generate`, which the\n * review checklist otherwise requires. The generator only diffs entities against\n * the schema snapshot, so it cannot emit a data repair, and there is no schema\n * change here to diff: no column, index, or constraint is touched, which is why\n * `.snapshot-open-mercato.json` is deliberately left untouched by this migration.\n *\n * @public Exported for testing\n */\nexport function buildRepairPoisonedCustomerEntityLinksSql(): string {\n  return `do $$\nbegin\n  if to_regclass('customer_entities') is null or to_regclass('customer_people') is null then\n    return;\n  end if;\n\n  update \"customer_users\" cu\n     set \"customer_entity_id\" = (\n           select company.\"id\"\n             from \"customer_entities\" person\n             join \"customer_people\" profile\n               on profile.\"entity_id\" = person.\"id\"\n              and profile.\"tenant_id\" = person.\"tenant_id\"\n              and profile.\"organization_id\" = person.\"organization_id\"\n             join \"customer_entities\" company\n               on company.\"id\" = profile.\"company_entity_id\"\n              and company.\"tenant_id\" = person.\"tenant_id\"\n              and company.\"organization_id\" = person.\"organization_id\"\n              and company.\"kind\" = 'company'\n              and company.\"deleted_at\" is null\n            where person.\"id\" = cu.\"customer_entity_id\"\n              and person.\"tenant_id\" = cu.\"tenant_id\"\n              and person.\"organization_id\" = cu.\"organization_id\"\n              and person.\"kind\" = 'person'\n              and person.\"deleted_at\" is null\n            order by profile.\"created_at\", profile.\"id\"\n            limit 1\n         ),\n         \"updated_at\" = now()\n   where cu.\"customer_entity_id\" is not null\n     and not exists (\n           select 1\n             from \"customer_entities\" company\n            where company.\"id\" = cu.\"customer_entity_id\"\n              and company.\"tenant_id\" = cu.\"tenant_id\"\n              and company.\"organization_id\" = cu.\"organization_id\"\n              and company.\"kind\" = 'company'\n              and company.\"deleted_at\" is null\n         );\nend\n$$;`;\n}\n\nexport class Migration20260724120000_customer_accounts extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(buildRepairPoisonedCustomerEntityLinksSql());\n  }\n\n  override down(): void | Promise<void> {\n    // Forward-only: the poisoned values are not recorded anywhere, so there is\n    // nothing to restore. Re-poisoning the column would reintroduce the bug.\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAwCnB,SAAS,4CAAoD;AAClE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyCT;AAEO,MAAM,kDAAkD,UAAU;AAAA,EAE9D,KAA2B;AAClC,SAAK,OAAO,0CAA0C,CAAC;AAAA,EACzD;AAAA,EAES,OAA6B;AAAA,EAGtC;AAEF;",
+  "names": []
+}

package/dist/modules/directory/api/organizations/route.js

@@ -29,7 +29,7 @@ import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/
 const rawBodySchema = z.object({}).passthrough();
 const viewSchema = z.object({
   page: z.coerce.number().min(1).default(1),
-  pageSize: z.coerce.number().min(1).max(200).default(50),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
   search: z.string().optional(),
   view: z.enum(["options", "manage", "tree"]).default("options"),
   ids: z.string().optional(),

package/dist/modules/directory/api/organizations/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/directory/api/organizations/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { organizationCreateSchema, organizationUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport {\n  computeHierarchyForOrganizations,\n  type ComputedHierarchy,\n  type ComputedOrganizationNode,\n} from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveOrganizationScopeForRequest,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { E } from '#generated/entities.ids.generated'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { organizationCrudEvents, organizationCrudIndexer } from '@open-mercato/core/modules/directory/commands/organizations'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport {\n  directoryTag,\n  directoryErrorSchema,\n  directoryOkSchema,\n  organizationListResponseSchema,\n} from '../openapi'\nimport { resolveIsSuperAdmin, enforceTenantSelection } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype CrudInput = Record<string, unknown>\nconst rawBodySchema = z.object({}).passthrough()\n\ntype TreeNode = {\n  id: string\n  name: string\n  parentId: string | null\n  tenantId: string | null\n  depth: number\n  ancestorIds: string[]\n  childIds: string[]\n  descendantIds: string[]\n  isActive: boolean\n  treePath: string | null\n  pathLabel: string\n  children: TreeNode[]\n}\n\nconst viewSchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(200).default(50),\n  search: z.string().optional(),\n  view: z.enum(['options', 'manage', 'tree']).default('options'),\n  ids: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n  includeInactive: z.enum(['true', 'false']).optional(),\n  status: z.enum(['all', 'active', 'inactive']).optional(),\n})\n\nfunction parseIds(raw: string | null): string[] | null {\n  if (!raw) return null\n  const ids = raw.split(',').map((s) => s.trim()).filter(Boolean)\n  return ids.length ? Array.from(new Set(ids)) : null\n}\n\nfunction stringId(value: unknown): string {\n  return String(value)\n}\n\nfunction enforceTenantScope(\n  authTenantId: string | null,\n  requestedTenantId: string | null,\n  isSuperAdmin: boolean,\n): string | null {\n  if (isSuperAdmin) {\n    return requestedTenantId || authTenantId || null\n  }\n  if (authTenantId && requestedTenantId && requestedTenantId !== authTenantId) {\n    return null\n  }\n  return requestedTenantId || authTenantId\n}\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['directory.organizations.view'] },\n    POST: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n    PUT: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n    DELETE: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n  },\n  orm: {\n    entity: Organization,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: organizationCrudEvents,\n  indexer: organizationCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'directory.organizations.create',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: ({ result }) => ({ id: String(result.id) }),\n      status: 201,\n    },\n    update: {\n      commandId: 'directory.organizations.update',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'directory.organizations.delete',\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const metadata = crud.metadata\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ items: [] }, { status: 401 })\n\n  const url = new URL(req.url)\n  const parsed = viewSchema.safeParse({\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    view: url.searchParams.get('view') ?? undefined,\n    ids: url.searchParams.get('ids') ?? undefined,\n    tenantId: url.searchParams.get('tenantId') ?? undefined,\n    includeInactive: url.searchParams.get('includeInactive') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ items: [] }, { status: 400 })\n\n  const query = parsed.data\n  const ids = parseIds(query.ids ?? null)\n  const requestedTenantRaw = query.tenantId ?? null\n  const normalizedRequestedTenantId = requestedTenantRaw && requestedTenantRaw.toLowerCase() === 'all' ? null : requestedTenantRaw\n  const authTenantId = auth.tenantId ?? null\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = (container.resolve('em') as EntityManager)\n  const allowAllTenants = isSuperAdmin && !normalizedRequestedTenantId && query.view === 'manage'\n  let tenantId = allowAllTenants ? null : enforceTenantScope(authTenantId, normalizedRequestedTenantId, isSuperAdmin)\n  const status = query.status ?? 'all'\n  const includeInactive = parseBooleanToken(query.includeInactive) === true || status !== 'active'\n\n  if (!allowAllTenants && !tenantId && !authTenantId && ids?.length) {\n    let scopedIds = ids\n    if (!isSuperAdmin) {\n      let allowedIds: string[] | null = null\n      try {\n        const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n        allowedIds = Array.isArray(scope.allowedIds) ? scope.allowedIds : null\n      } catch {}\n      const allowedSet = allowedIds ? new Set(allowedIds) : new Set<string>()\n      scopedIds = ids.filter((id) => allowedSet.has(id))\n    }\n    if (scopedIds.length) {\n      const scopedOrgs: Organization[] = await findWithDecryption(\n        em,\n        Organization,\n        { id: { $in: scopedIds }, deletedAt: null },\n        { populate: ['tenant'] },\n        { tenantId: authTenantId, organizationId: null },\n      )\n      const tenantCandidates = new Set<string>()\n      for (const org of scopedOrgs) {\n        const orgTenantId = org.tenant?.id ? stringId(org.tenant.id) : ''\n        if (orgTenantId) tenantCandidates.add(orgTenantId)\n      }\n      if (tenantCandidates.size === 1) {\n        const candidateTenantId = Array.from(tenantCandidates)[0] ?? null\n        try {\n          tenantId = await enforceTenantSelection({ auth, container }, candidateTenantId)\n        } catch (error) {\n          if (isCrudHttpError(error)) {\n            return NextResponse.json(error.body, { status: error.status })\n          }\n          throw error\n        }\n      } else if (tenantCandidates.size > 1) {\n        return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n      }\n    }\n  }\n\n  if (!allowAllTenants && !tenantId) {\n    const candidateOrgIds = new Set<string>()\n    const cookieOrgId = getSelectedOrganizationFromRequest(req)\n    const effectiveCookieOrgId = cookieOrgId && !isAllOrganizationsSelection(cookieOrgId) ? cookieOrgId : null\n    if (effectiveCookieOrgId) candidateOrgIds.add(effectiveCookieOrgId)\n    if (auth.orgId) candidateOrgIds.add(auth.orgId)\n\n    try {\n      const scope = await resolveOrganizationScopeForRequest({\n        container,\n        auth,\n        request: req,\n        selectedId: effectiveCookieOrgId ?? undefined,\n      })\n      if (scope.selectedId) candidateOrgIds.add(scope.selectedId)\n      if (Array.isArray(scope.filterIds) && scope.filterIds.length) {\n        candidateOrgIds.add(scope.filterIds[0]!)\n      }\n      if (Array.isArray(scope.allowedIds) && scope.allowedIds.length) {\n        candidateOrgIds.add(scope.allowedIds[0]!)\n      }\n    } catch {}\n\n    for (const orgId of candidateOrgIds) {\n      if (!orgId) continue\n      const org = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: orgId, deletedAt: null },\n        { populate: ['tenant'] },\n        { tenantId: authTenantId, organizationId: orgId },\n      )\n      if (org?.tenant && org.tenant.id) {\n        tenantId = stringId(org.tenant.id)\n        break\n      }\n    }\n  }\n\n  if (!allowAllTenants && !tenantId) {\n    return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n  }\n\n  if (query.view === 'options') {\n    if (!tenantId) {\n      return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n    }\n    const where: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n    if (status === 'active') where.isActive = true\n    if (status === 'inactive') where.isActive = false\n    if (status === 'all' && !includeInactive) where.isActive = true\n    if (ids) where.id = { $in: ids }\n    const orgs = await em.find(Organization, where, { orderBy: { name: 'ASC' } })\n    const items = orgs.map((org) => ({\n      id: stringId(org.id),\n      name: org.name,\n      logoUrl: org.logoUrl ?? null,\n      parentId: org.parentId ?? null,\n      tenantId: tenantId,\n      isActive: !!org.isActive,\n      depth: org.depth ?? 0,\n      treePath: org.treePath ?? stringId(org.id),\n    }))\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId,\n      query,\n      accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n    })\n    return NextResponse.json({ items })\n  }\n\n  if (query.view === 'tree') {\n    if (!tenantId) {\n      return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n    }\n    const orgListFilter: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n    const orgs = await em.find(Organization, orgListFilter, { orderBy: { name: 'ASC' } })\n    const hierarchy = computeHierarchyForOrganizations(orgs, tenantId)\n    const nodeMap = new Map<string, { node: ComputedOrganizationNode; children: TreeNode[] }>()\n    const roots: TreeNode[] = []\n    for (const node of hierarchy.ordered) {\n      const treeNode: TreeNode = {\n        id: node.id,\n        name: node.name,\n        parentId: node.parentId,\n        tenantId: node.tenantId,\n        depth: node.depth,\n        ancestorIds: node.ancestorIds,\n        childIds: node.childIds,\n        descendantIds: node.descendantIds,\n        isActive: node.isActive,\n        treePath: node.treePath,\n        pathLabel: node.pathLabel,\n        children: [],\n      }\n      nodeMap.set(node.id, { node, children: treeNode.children })\n      if (node.parentId && nodeMap.has(node.parentId)) {\n        const parentEntry = nodeMap.get(node.parentId)!\n        parentEntry.children.push(treeNode)\n      } else {\n        roots.push(treeNode)\n      }\n    }\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items: roots,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId,\n      query,\n    })\n    return NextResponse.json({ items: roots })\n  }\n\n  if (query.view !== 'manage') {\n    return NextResponse.json({ items: [] }, { status: 400 })\n  }\n\n  if (allowAllTenants) {\n    // Multi-tenant aggregate view for super administrators\n    const search = (query.search || '').trim().toLowerCase()\n    const allOrgs = await findWithDecryption(\n      em,\n      Organization,\n      { deletedAt: null },\n      { orderBy: { name: 'ASC' }, populate: ['tenant'] },\n      { tenantId: null, organizationId: null },\n    )\n    const byTenant = new Map<string, Organization[]>()\n    for (const org of allOrgs) {\n      const tenantEntity = org.tenant\n      const tid = tenantEntity ? stringId(tenantEntity.id) : null\n      if (!tid) continue\n      if (!byTenant.has(tid)) byTenant.set(tid, [])\n      byTenant.get(tid)!.push(org)\n    }\n\n    const slugByOrgId = new Map<string, string | null>()\n    const updatedAtByOrgId = new Map<string, string | null>()\n    const logoUrlByOrgId = new Map<string, string | null>()\n    for (const org of allOrgs) {\n      slugByOrgId.set(String(org.id), org.slug ?? null)\n      updatedAtByOrgId.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null)\n      logoUrlByOrgId.set(String(org.id), org.logoUrl ?? null)\n    }\n\n    const tenantIds = Array.from(byTenant.keys())\n    const tenants = tenantIds.length\n      ? await em.find(Tenant, { id: { $in: tenantIds as unknown as string[] } })\n      : []\n    const tenantNameMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n      const tid = stringId(tenant.id)\n      const name = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : tid\n      acc[tid] = name\n      return acc\n    }, {})\n\n    const hierarchies = new Map<string, ComputedHierarchy>()\n    const orderedNodes: Array<{ tenantId: string; node: ComputedOrganizationNode }> = []\n    for (const [tid, orgs] of byTenant.entries()) {\n      const hierarchy = computeHierarchyForOrganizations(orgs, tid)\n      hierarchies.set(tid, hierarchy)\n      for (const node of hierarchy.ordered) {\n        orderedNodes.push({ tenantId: tid, node })\n      }\n    }\n\n    let rows = orderedNodes\n    if (query.status === 'active') {\n      rows = rows.filter((entry) => entry.node.isActive)\n    } else if (query.status === 'inactive') {\n      rows = rows.filter((entry) => !entry.node.isActive)\n    }\n\n    if (search) {\n      rows = rows.filter(({ node }) => {\n        const pathLabel = (node.pathLabel || '').toLowerCase()\n        return node.name.toLowerCase().includes(search) || pathLabel.includes(search)\n      })\n    }\n    if (ids) {\n      const idSet = new Set(ids)\n      rows = rows.filter(({ node }) => idSet.has(node.id))\n    }\n\n    rows.sort((a, b) => {\n      const nameA = tenantNameMap[a.tenantId] ?? a.tenantId\n      const nameB = tenantNameMap[b.tenantId] ?? b.tenantId\n      const tenantCompare = nameA.localeCompare(nameB)\n      if (tenantCompare !== 0) return tenantCompare\n      return a.node.pathLabel.localeCompare(b.node.pathLabel)\n    })\n\n    const total = rows.length\n    const pageSize = query.pageSize\n    const page = query.page\n    const start = (page - 1) * pageSize\n    const paged = rows.slice(start, start + pageSize)\n    const recordIds: string[] = []\n    const tenantIdByRecord: Record<string, string | null> = {}\n    const organizationIdByRecord: Record<string, string | null> = {}\n    for (const entry of paged) {\n      const recordId = String(entry.node.id)\n      recordIds.push(recordId)\n      tenantIdByRecord[recordId] = entry.tenantId\n      organizationIdByRecord[recordId] = recordId\n    }\n    const tenantFallbacks = Array.from(new Set(recordIds.map((id) => tenantIdByRecord[id]).filter((value): value is string => typeof value === 'string' && value.length > 0)))\n    const cfByOrg = recordIds.length\n      ? await loadCustomFieldValues({\n          em,\n          entityId: E.directory.organization,\n          recordIds,\n          tenantIdByRecord,\n          organizationIdByRecord,\n          tenantFallbacks,\n        })\n      : {}\n    const items = paged.map(({ tenantId: tid, node }) => {\n      const hierarchy = hierarchies.get(tid)\n      const parentName = node.parentId && hierarchy ? hierarchy.map.get(node.parentId)?.name ?? null : null\n      const pathLabel = node.pathLabel || node.name\n      const recordId = String(node.id)\n      return {\n        id: node.id,\n        name: node.name,\n        slug: slugByOrgId.get(recordId) ?? null,\n        updatedAt: updatedAtByOrgId.get(recordId) ?? null,\n        logoUrl: logoUrlByOrgId.get(recordId) ?? null,\n        tenantId: tid,\n        tenantName: tenantNameMap[tid] ?? tid,\n        parentId: node.parentId,\n        parentName,\n        depth: node.depth,\n        rootId: node.rootId,\n        treePath: node.treePath,\n        pathLabel,\n        ancestorIds: node.ancestorIds,\n        childIds: node.childIds,\n        descendantIds: node.descendantIds,\n        childrenCount: node.childIds.length,\n        descendantsCount: node.descendantIds.length,\n        isActive: node.isActive,\n        ...(cfByOrg[recordId] ?? {}),\n      }\n    })\n    const totalPages = Math.max(1, Math.ceil(total / pageSize))\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId: null,\n      query,\n      accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n    })\n    return NextResponse.json({ items, total, page, pageSize, totalPages, isSuperAdmin })\n  }\n\n  if (!tenantId) {\n    return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n  }\n\n  const orgListFilter: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n  const orgs = await em.find(Organization, orgListFilter, { orderBy: { name: 'ASC' } })\n  const hierarchy = computeHierarchyForOrganizations(orgs, tenantId)\n  const slugByOrgId = new Map<string, string | null>()\n  const logoUrlByOrgId = new Map<string, string | null>()\n  const updatedAtByOrgId = new Map<string, string | null>()\n  for (const org of orgs) {\n    slugByOrgId.set(String(org.id), org.slug ?? null)\n    logoUrlByOrgId.set(String(org.id), org.logoUrl ?? null)\n    updatedAtByOrgId.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null)\n  }\n\n  // Manage view: paginated flat list for a single tenant\n  const search = (query.search || '').trim().toLowerCase()\n  let rows = hierarchy.ordered\n  if (status === 'active') {\n    rows = rows.filter((node) => node.isActive)\n  } else if (status === 'inactive') {\n    rows = rows.filter((node) => !node.isActive)\n  }\n\n  if (search) {\n    rows = rows.filter((node) => {\n      const pathLabel = (node.pathLabel || '').toLowerCase()\n      return node.name.toLowerCase().includes(search) || pathLabel.includes(search)\n    })\n  }\n  if (ids) {\n    const idSet = new Set(ids)\n    rows = rows.filter((node) => idSet.has(node.id))\n  }\n\n  const total = rows.length\n  const pageSize = query.pageSize\n  const page = query.page\n  const start = (page - 1) * pageSize\n  const paged = rows.slice(start, start + pageSize)\n  const recordIds: string[] = []\n  const tenantIdByRecord: Record<string, string | null> = {}\n  const organizationIdByRecord: Record<string, string | null> = {}\n  for (const node of paged) {\n    const recordId = String(node.id)\n    recordIds.push(recordId)\n    tenantIdByRecord[recordId] = node.tenantId ? String(node.tenantId) : null\n    organizationIdByRecord[recordId] = recordId\n  }\n  const cfByOrg = recordIds.length\n    ? await loadCustomFieldValues({\n        em,\n        entityId: E.directory.organization,\n        recordIds,\n        tenantIdByRecord,\n        organizationIdByRecord,\n        tenantFallbacks: tenantId ? [tenantId] : [],\n      })\n    : {}\n  let tenantName: string | null = null\n  if (isSuperAdmin && tenantId) {\n    const tenant = await em.findOne(Tenant, { id: tenantId })\n    if (tenant) {\n      const display = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : stringId(tenant.id)\n      tenantName = display\n    }\n  }\n  const items = paged.map((node) => {\n    const parentName = node.parentId ? hierarchy.map.get(node.parentId)?.name ?? null : null\n    const pathLabel = node.pathLabel || node.name\n    const recordId = String(node.id)\n    return {\n      id: node.id,\n      name: node.name,\n      slug: slugByOrgId.get(recordId) ?? null,\n      logoUrl: logoUrlByOrgId.get(recordId) ?? null,\n      updatedAt: updatedAtByOrgId.get(recordId) ?? null,\n      tenantId: node.tenantId,\n      tenantName,\n      parentId: node.parentId,\n      parentName,\n      depth: node.depth,\n      rootId: node.rootId,\n      treePath: node.treePath,\n      pathLabel,\n      ancestorIds: node.ancestorIds,\n      childIds: node.childIds,\n      descendantIds: node.descendantIds,\n      childrenCount: node.childIds.length,\n      descendantsCount: node.descendantIds.length,\n      isActive: node.isActive,\n      ...(cfByOrg[recordId] ?? {}),\n    }\n  })\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'directory.organization',\n    organizationId: null,\n    tenantId,\n    query,\n    accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n  })\n  return NextResponse.json({ items, total, page, pageSize, totalPages, isSuperAdmin })\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst organizationCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst organizationDeleteRequestSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst organizationsGetDoc: OpenApiMethodDoc = {\n  summary: 'List organizations',\n  description: 'Returns organizations using options, tree, or paginated manage view depending on the `view` parameter.',\n  tags: [directoryTag],\n  query: viewSchema,\n  responses: [\n    { status: 200, description: 'Organization data for the requested view.', schema: organizationListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query or tenant scope', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsPostDoc: OpenApiMethodDoc = {\n  summary: 'Create organization',\n  description: 'Creates a new organization within a tenant and optionally assigns hierarchy relationships.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationCreateSchema,\n    description: 'Organization attributes and optional hierarchy configuration.',\n  },\n  responses: [\n    { status: 201, description: 'Organization created.', schema: organizationCreateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update organization',\n  description: 'Updates organization details and hierarchy assignments.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationUpdateSchema,\n    description: 'Organization identifier followed by fields to update.',\n  },\n  responses: [\n    { status: 200, description: 'Organization updated.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete organization',\n  description: 'Soft deletes an organization identified by id.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationDeleteRequestSchema,\n    description: 'Identifier of the organization to delete.',\n  },\n  responses: [\n    { status: 200, description: 'Organization deleted.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: directoryTag,\n  summary: 'Manage organizations',\n  methods: {\n    GET: organizationsGetDoc,\n    POST: organizationsPostDoc,\n    PUT: organizationsPutDoc,\n    DELETE: organizationsDeleteDoc,\n  },\n}\n"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { logCrudAccess, makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { organizationCreateSchema, organizationUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport {\n  computeHierarchyForOrganizations,\n  type ComputedHierarchy,\n  type ComputedOrganizationNode,\n} from '@open-mercato/core/modules/directory/lib/hierarchy'\nimport { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'\nimport {\n  getSelectedOrganizationFromRequest,\n  resolveOrganizationScopeForRequest,\n} from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { E } from '#generated/entities.ids.generated'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { FilterQuery } from '@mikro-orm/core'\nimport { organizationCrudEvents, organizationCrudIndexer } from '@open-mercato/core/modules/directory/commands/organizations'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport {\n  directoryTag,\n  directoryErrorSchema,\n  directoryOkSchema,\n  organizationListResponseSchema,\n} from '../openapi'\nimport { resolveIsSuperAdmin, enforceTenantSelection } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype CrudInput = Record<string, unknown>\nconst rawBodySchema = z.object({}).passthrough()\n\ntype TreeNode = {\n  id: string\n  name: string\n  parentId: string | null\n  tenantId: string | null\n  depth: number\n  ancestorIds: string[]\n  childIds: string[]\n  descendantIds: string[]\n  isActive: boolean\n  treePath: string | null\n  pathLabel: string\n  children: TreeNode[]\n}\n\nconst viewSchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(50),\n  search: z.string().optional(),\n  view: z.enum(['options', 'manage', 'tree']).default('options'),\n  ids: z.string().optional(),\n  tenantId: z.string().uuid().optional(),\n  includeInactive: z.enum(['true', 'false']).optional(),\n  status: z.enum(['all', 'active', 'inactive']).optional(),\n})\n\nfunction parseIds(raw: string | null): string[] | null {\n  if (!raw) return null\n  const ids = raw.split(',').map((s) => s.trim()).filter(Boolean)\n  return ids.length ? Array.from(new Set(ids)) : null\n}\n\nfunction stringId(value: unknown): string {\n  return String(value)\n}\n\nfunction enforceTenantScope(\n  authTenantId: string | null,\n  requestedTenantId: string | null,\n  isSuperAdmin: boolean,\n): string | null {\n  if (isSuperAdmin) {\n    return requestedTenantId || authTenantId || null\n  }\n  if (authTenantId && requestedTenantId && requestedTenantId !== authTenantId) {\n    return null\n  }\n  return requestedTenantId || authTenantId\n}\n\nconst crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({\n  metadata: {\n    GET: { requireAuth: true, requireFeatures: ['directory.organizations.view'] },\n    POST: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n    PUT: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n    DELETE: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n  },\n  orm: {\n    entity: Organization,\n    idField: 'id',\n    orgField: null,\n    tenantField: null,\n    softDeleteField: 'deletedAt',\n  },\n  events: organizationCrudEvents,\n  indexer: organizationCrudIndexer,\n  actions: {\n    create: {\n      commandId: 'directory.organizations.create',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: ({ result }) => ({ id: String(result.id) }),\n      status: 201,\n    },\n    update: {\n      commandId: 'directory.organizations.update',\n      schema: rawBodySchema,\n      mapInput: ({ parsed }) => parsed,\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'directory.organizations.delete',\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const metadata = crud.metadata\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ items: [] }, { status: 401 })\n\n  const url = new URL(req.url)\n  const parsed = viewSchema.safeParse({\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    view: url.searchParams.get('view') ?? undefined,\n    ids: url.searchParams.get('ids') ?? undefined,\n    tenantId: url.searchParams.get('tenantId') ?? undefined,\n    includeInactive: url.searchParams.get('includeInactive') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ items: [] }, { status: 400 })\n\n  const query = parsed.data\n  const ids = parseIds(query.ids ?? null)\n  const requestedTenantRaw = query.tenantId ?? null\n  const normalizedRequestedTenantId = requestedTenantRaw && requestedTenantRaw.toLowerCase() === 'all' ? null : requestedTenantRaw\n  const authTenantId = auth.tenantId ?? null\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = (container.resolve('em') as EntityManager)\n  const allowAllTenants = isSuperAdmin && !normalizedRequestedTenantId && query.view === 'manage'\n  let tenantId = allowAllTenants ? null : enforceTenantScope(authTenantId, normalizedRequestedTenantId, isSuperAdmin)\n  const status = query.status ?? 'all'\n  const includeInactive = parseBooleanToken(query.includeInactive) === true || status !== 'active'\n\n  if (!allowAllTenants && !tenantId && !authTenantId && ids?.length) {\n    let scopedIds = ids\n    if (!isSuperAdmin) {\n      let allowedIds: string[] | null = null\n      try {\n        const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n        allowedIds = Array.isArray(scope.allowedIds) ? scope.allowedIds : null\n      } catch {}\n      const allowedSet = allowedIds ? new Set(allowedIds) : new Set<string>()\n      scopedIds = ids.filter((id) => allowedSet.has(id))\n    }\n    if (scopedIds.length) {\n      const scopedOrgs: Organization[] = await findWithDecryption(\n        em,\n        Organization,\n        { id: { $in: scopedIds }, deletedAt: null },\n        { populate: ['tenant'] },\n        { tenantId: authTenantId, organizationId: null },\n      )\n      const tenantCandidates = new Set<string>()\n      for (const org of scopedOrgs) {\n        const orgTenantId = org.tenant?.id ? stringId(org.tenant.id) : ''\n        if (orgTenantId) tenantCandidates.add(orgTenantId)\n      }\n      if (tenantCandidates.size === 1) {\n        const candidateTenantId = Array.from(tenantCandidates)[0] ?? null\n        try {\n          tenantId = await enforceTenantSelection({ auth, container }, candidateTenantId)\n        } catch (error) {\n          if (isCrudHttpError(error)) {\n            return NextResponse.json(error.body, { status: error.status })\n          }\n          throw error\n        }\n      } else if (tenantCandidates.size > 1) {\n        return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n      }\n    }\n  }\n\n  if (!allowAllTenants && !tenantId) {\n    const candidateOrgIds = new Set<string>()\n    const cookieOrgId = getSelectedOrganizationFromRequest(req)\n    const effectiveCookieOrgId = cookieOrgId && !isAllOrganizationsSelection(cookieOrgId) ? cookieOrgId : null\n    if (effectiveCookieOrgId) candidateOrgIds.add(effectiveCookieOrgId)\n    if (auth.orgId) candidateOrgIds.add(auth.orgId)\n\n    try {\n      const scope = await resolveOrganizationScopeForRequest({\n        container,\n        auth,\n        request: req,\n        selectedId: effectiveCookieOrgId ?? undefined,\n      })\n      if (scope.selectedId) candidateOrgIds.add(scope.selectedId)\n      if (Array.isArray(scope.filterIds) && scope.filterIds.length) {\n        candidateOrgIds.add(scope.filterIds[0]!)\n      }\n      if (Array.isArray(scope.allowedIds) && scope.allowedIds.length) {\n        candidateOrgIds.add(scope.allowedIds[0]!)\n      }\n    } catch {}\n\n    for (const orgId of candidateOrgIds) {\n      if (!orgId) continue\n      const org = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: orgId, deletedAt: null },\n        { populate: ['tenant'] },\n        { tenantId: authTenantId, organizationId: orgId },\n      )\n      if (org?.tenant && org.tenant.id) {\n        tenantId = stringId(org.tenant.id)\n        break\n      }\n    }\n  }\n\n  if (!allowAllTenants && !tenantId) {\n    return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n  }\n\n  if (query.view === 'options') {\n    if (!tenantId) {\n      return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n    }\n    const where: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n    if (status === 'active') where.isActive = true\n    if (status === 'inactive') where.isActive = false\n    if (status === 'all' && !includeInactive) where.isActive = true\n    if (ids) where.id = { $in: ids }\n    const orgs = await em.find(Organization, where, { orderBy: { name: 'ASC' } })\n    const items = orgs.map((org) => ({\n      id: stringId(org.id),\n      name: org.name,\n      logoUrl: org.logoUrl ?? null,\n      parentId: org.parentId ?? null,\n      tenantId: tenantId,\n      isActive: !!org.isActive,\n      depth: org.depth ?? 0,\n      treePath: org.treePath ?? stringId(org.id),\n    }))\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId,\n      query,\n      accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n    })\n    return NextResponse.json({ items })\n  }\n\n  if (query.view === 'tree') {\n    if (!tenantId) {\n      return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n    }\n    const orgListFilter: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n    const orgs = await em.find(Organization, orgListFilter, { orderBy: { name: 'ASC' } })\n    const hierarchy = computeHierarchyForOrganizations(orgs, tenantId)\n    const nodeMap = new Map<string, { node: ComputedOrganizationNode; children: TreeNode[] }>()\n    const roots: TreeNode[] = []\n    for (const node of hierarchy.ordered) {\n      const treeNode: TreeNode = {\n        id: node.id,\n        name: node.name,\n        parentId: node.parentId,\n        tenantId: node.tenantId,\n        depth: node.depth,\n        ancestorIds: node.ancestorIds,\n        childIds: node.childIds,\n        descendantIds: node.descendantIds,\n        isActive: node.isActive,\n        treePath: node.treePath,\n        pathLabel: node.pathLabel,\n        children: [],\n      }\n      nodeMap.set(node.id, { node, children: treeNode.children })\n      if (node.parentId && nodeMap.has(node.parentId)) {\n        const parentEntry = nodeMap.get(node.parentId)!\n        parentEntry.children.push(treeNode)\n      } else {\n        roots.push(treeNode)\n      }\n    }\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items: roots,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId,\n      query,\n    })\n    return NextResponse.json({ items: roots })\n  }\n\n  if (query.view !== 'manage') {\n    return NextResponse.json({ items: [] }, { status: 400 })\n  }\n\n  if (allowAllTenants) {\n    // Multi-tenant aggregate view for super administrators\n    const search = (query.search || '').trim().toLowerCase()\n    const allOrgs = await findWithDecryption(\n      em,\n      Organization,\n      { deletedAt: null },\n      { orderBy: { name: 'ASC' }, populate: ['tenant'] },\n      { tenantId: null, organizationId: null },\n    )\n    const byTenant = new Map<string, Organization[]>()\n    for (const org of allOrgs) {\n      const tenantEntity = org.tenant\n      const tid = tenantEntity ? stringId(tenantEntity.id) : null\n      if (!tid) continue\n      if (!byTenant.has(tid)) byTenant.set(tid, [])\n      byTenant.get(tid)!.push(org)\n    }\n\n    const slugByOrgId = new Map<string, string | null>()\n    const updatedAtByOrgId = new Map<string, string | null>()\n    const logoUrlByOrgId = new Map<string, string | null>()\n    for (const org of allOrgs) {\n      slugByOrgId.set(String(org.id), org.slug ?? null)\n      updatedAtByOrgId.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null)\n      logoUrlByOrgId.set(String(org.id), org.logoUrl ?? null)\n    }\n\n    const tenantIds = Array.from(byTenant.keys())\n    const tenants = tenantIds.length\n      ? await em.find(Tenant, { id: { $in: tenantIds as unknown as string[] } })\n      : []\n    const tenantNameMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n      const tid = stringId(tenant.id)\n      const name = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : tid\n      acc[tid] = name\n      return acc\n    }, {})\n\n    const hierarchies = new Map<string, ComputedHierarchy>()\n    const orderedNodes: Array<{ tenantId: string; node: ComputedOrganizationNode }> = []\n    for (const [tid, orgs] of byTenant.entries()) {\n      const hierarchy = computeHierarchyForOrganizations(orgs, tid)\n      hierarchies.set(tid, hierarchy)\n      for (const node of hierarchy.ordered) {\n        orderedNodes.push({ tenantId: tid, node })\n      }\n    }\n\n    let rows = orderedNodes\n    if (query.status === 'active') {\n      rows = rows.filter((entry) => entry.node.isActive)\n    } else if (query.status === 'inactive') {\n      rows = rows.filter((entry) => !entry.node.isActive)\n    }\n\n    if (search) {\n      rows = rows.filter(({ node }) => {\n        const pathLabel = (node.pathLabel || '').toLowerCase()\n        return node.name.toLowerCase().includes(search) || pathLabel.includes(search)\n      })\n    }\n    if (ids) {\n      const idSet = new Set(ids)\n      rows = rows.filter(({ node }) => idSet.has(node.id))\n    }\n\n    rows.sort((a, b) => {\n      const nameA = tenantNameMap[a.tenantId] ?? a.tenantId\n      const nameB = tenantNameMap[b.tenantId] ?? b.tenantId\n      const tenantCompare = nameA.localeCompare(nameB)\n      if (tenantCompare !== 0) return tenantCompare\n      return a.node.pathLabel.localeCompare(b.node.pathLabel)\n    })\n\n    const total = rows.length\n    const pageSize = query.pageSize\n    const page = query.page\n    const start = (page - 1) * pageSize\n    const paged = rows.slice(start, start + pageSize)\n    const recordIds: string[] = []\n    const tenantIdByRecord: Record<string, string | null> = {}\n    const organizationIdByRecord: Record<string, string | null> = {}\n    for (const entry of paged) {\n      const recordId = String(entry.node.id)\n      recordIds.push(recordId)\n      tenantIdByRecord[recordId] = entry.tenantId\n      organizationIdByRecord[recordId] = recordId\n    }\n    const tenantFallbacks = Array.from(new Set(recordIds.map((id) => tenantIdByRecord[id]).filter((value): value is string => typeof value === 'string' && value.length > 0)))\n    const cfByOrg = recordIds.length\n      ? await loadCustomFieldValues({\n          em,\n          entityId: E.directory.organization,\n          recordIds,\n          tenantIdByRecord,\n          organizationIdByRecord,\n          tenantFallbacks,\n        })\n      : {}\n    const items = paged.map(({ tenantId: tid, node }) => {\n      const hierarchy = hierarchies.get(tid)\n      const parentName = node.parentId && hierarchy ? hierarchy.map.get(node.parentId)?.name ?? null : null\n      const pathLabel = node.pathLabel || node.name\n      const recordId = String(node.id)\n      return {\n        id: node.id,\n        name: node.name,\n        slug: slugByOrgId.get(recordId) ?? null,\n        updatedAt: updatedAtByOrgId.get(recordId) ?? null,\n        logoUrl: logoUrlByOrgId.get(recordId) ?? null,\n        tenantId: tid,\n        tenantName: tenantNameMap[tid] ?? tid,\n        parentId: node.parentId,\n        parentName,\n        depth: node.depth,\n        rootId: node.rootId,\n        treePath: node.treePath,\n        pathLabel,\n        ancestorIds: node.ancestorIds,\n        childIds: node.childIds,\n        descendantIds: node.descendantIds,\n        childrenCount: node.childIds.length,\n        descendantsCount: node.descendantIds.length,\n        isActive: node.isActive,\n        ...(cfByOrg[recordId] ?? {}),\n      }\n    })\n    const totalPages = Math.max(1, Math.ceil(total / pageSize))\n    await logCrudAccess({\n      container,\n      auth,\n      request: req,\n      items,\n      idField: 'id',\n      resourceKind: 'directory.organization',\n      organizationId: null,\n      tenantId: null,\n      query,\n      accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n    })\n    return NextResponse.json({ items, total, page, pageSize, totalPages, isSuperAdmin })\n  }\n\n  if (!tenantId) {\n    return NextResponse.json({ items: [], error: 'Tenant scope required' }, { status: 400 })\n  }\n\n  const orgListFilter: FilterQuery<Organization> = { tenant: tenantId, deletedAt: null }\n  const orgs = await em.find(Organization, orgListFilter, { orderBy: { name: 'ASC' } })\n  const hierarchy = computeHierarchyForOrganizations(orgs, tenantId)\n  const slugByOrgId = new Map<string, string | null>()\n  const logoUrlByOrgId = new Map<string, string | null>()\n  const updatedAtByOrgId = new Map<string, string | null>()\n  for (const org of orgs) {\n    slugByOrgId.set(String(org.id), org.slug ?? null)\n    logoUrlByOrgId.set(String(org.id), org.logoUrl ?? null)\n    updatedAtByOrgId.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null)\n  }\n\n  // Manage view: paginated flat list for a single tenant\n  const search = (query.search || '').trim().toLowerCase()\n  let rows = hierarchy.ordered\n  if (status === 'active') {\n    rows = rows.filter((node) => node.isActive)\n  } else if (status === 'inactive') {\n    rows = rows.filter((node) => !node.isActive)\n  }\n\n  if (search) {\n    rows = rows.filter((node) => {\n      const pathLabel = (node.pathLabel || '').toLowerCase()\n      return node.name.toLowerCase().includes(search) || pathLabel.includes(search)\n    })\n  }\n  if (ids) {\n    const idSet = new Set(ids)\n    rows = rows.filter((node) => idSet.has(node.id))\n  }\n\n  const total = rows.length\n  const pageSize = query.pageSize\n  const page = query.page\n  const start = (page - 1) * pageSize\n  const paged = rows.slice(start, start + pageSize)\n  const recordIds: string[] = []\n  const tenantIdByRecord: Record<string, string | null> = {}\n  const organizationIdByRecord: Record<string, string | null> = {}\n  for (const node of paged) {\n    const recordId = String(node.id)\n    recordIds.push(recordId)\n    tenantIdByRecord[recordId] = node.tenantId ? String(node.tenantId) : null\n    organizationIdByRecord[recordId] = recordId\n  }\n  const cfByOrg = recordIds.length\n    ? await loadCustomFieldValues({\n        em,\n        entityId: E.directory.organization,\n        recordIds,\n        tenantIdByRecord,\n        organizationIdByRecord,\n        tenantFallbacks: tenantId ? [tenantId] : [],\n      })\n    : {}\n  let tenantName: string | null = null\n  if (isSuperAdmin && tenantId) {\n    const tenant = await em.findOne(Tenant, { id: tenantId })\n    if (tenant) {\n      const display = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : stringId(tenant.id)\n      tenantName = display\n    }\n  }\n  const items = paged.map((node) => {\n    const parentName = node.parentId ? hierarchy.map.get(node.parentId)?.name ?? null : null\n    const pathLabel = node.pathLabel || node.name\n    const recordId = String(node.id)\n    return {\n      id: node.id,\n      name: node.name,\n      slug: slugByOrgId.get(recordId) ?? null,\n      logoUrl: logoUrlByOrgId.get(recordId) ?? null,\n      updatedAt: updatedAtByOrgId.get(recordId) ?? null,\n      tenantId: node.tenantId,\n      tenantName,\n      parentId: node.parentId,\n      parentName,\n      depth: node.depth,\n      rootId: node.rootId,\n      treePath: node.treePath,\n      pathLabel,\n      ancestorIds: node.ancestorIds,\n      childIds: node.childIds,\n      descendantIds: node.descendantIds,\n      childrenCount: node.childIds.length,\n      descendantsCount: node.descendantIds.length,\n      isActive: node.isActive,\n      ...(cfByOrg[recordId] ?? {}),\n    }\n  })\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items,\n    idField: 'id',\n    resourceKind: 'directory.organization',\n    organizationId: null,\n    tenantId,\n    query,\n    accessType: ids && ids.length === 1 ? 'read:item' : undefined,\n  })\n  return NextResponse.json({ items, total, page, pageSize, totalPages, isSuperAdmin })\n}\n\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst organizationCreateResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst organizationDeleteRequestSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst organizationsGetDoc: OpenApiMethodDoc = {\n  summary: 'List organizations',\n  description: 'Returns organizations using options, tree, or paginated manage view depending on the `view` parameter.',\n  tags: [directoryTag],\n  query: viewSchema,\n  responses: [\n    { status: 200, description: 'Organization data for the requested view.', schema: organizationListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid query or tenant scope', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsPostDoc: OpenApiMethodDoc = {\n  summary: 'Create organization',\n  description: 'Creates a new organization within a tenant and optionally assigns hierarchy relationships.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationCreateSchema,\n    description: 'Organization attributes and optional hierarchy configuration.',\n  },\n  responses: [\n    { status: 201, description: 'Organization created.', schema: organizationCreateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update organization',\n  description: 'Updates organization details and hierarchy assignments.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationUpdateSchema,\n    description: 'Organization identifier followed by fields to update.',\n  },\n  responses: [\n    { status: 200, description: 'Organization updated.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nconst organizationsDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete organization',\n  description: 'Soft deletes an organization identified by id.',\n  tags: [directoryTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: organizationDeleteRequestSchema,\n    description: 'Identifier of the organization to delete.',\n  },\n  responses: [\n    { status: 200, description: 'Organization deleted.', schema: directoryOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: directoryErrorSchema },\n    { status: 401, description: 'Authentication required', schema: directoryErrorSchema },\n    { status: 403, description: 'Missing directory.organizations.manage feature', schema: directoryErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: directoryTag,\n  summary: 'Manage organizations',\n  methods: {\n    GET: organizationsGetDoc,\n    POST: organizationsPostDoc,\n    PUT: organizationsPutDoc,\n    DELETE: organizationsDeleteDoc,\n  },\n}\n"],
   "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,eAAe,qBAAqB;AAC7C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,cAAc,cAAc;AACrC,SAAS,0BAA0B,gCAAgC;AACnE;AAAA,EACE;AAAA,OAGK;AACP,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAGlB,SAAS,wBAAwB,+BAA+B;AAEhE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,8BAA8B;AAC5D,SAAS,uBAAuB;AAChC,SAAS,oBAAoB,6BAA6B;AAG1D,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAiB/C,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,UAAU,MAAM,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC7D,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,KAAK,CAAC,OAAO,UAAU,UAAU,CAAC,EAAE,SAAS;AACzD,CAAC;AAED,SAAS,SAAS,KAAqC;AACrD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAM,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC9D,SAAO,IAAI,SAAS,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI;AACjD;AAEA,SAAS,SAAS,OAAwB;AACxC,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,mBACP,cACA,mBACA,cACe;AACf,MAAI,cAAc;AAChB,WAAO,qBAAqB,gBAAgB;AAAA,EAC9C;AACA,MAAI,gBAAgB,qBAAqB,sBAAsB,cAAc;AAC3E,WAAO;AAAA,EACT;AACA,SAAO,qBAAqB;AAC9B;AAEA,MAAM,OAAO,cAA6D;AAAA,EACxE,UAAU;AAAA,IACR,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAAA,IAC5E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,IAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,IAC9E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAAA,EACnF;AAAA,EACA,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,OAAO,OAAO,EAAE,EAAE;AAAA,MACnD,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,CAAC,EAAE,OAAO,MAAM;AAAA,MAC1B,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,WAAW,KAAK;AAE7B,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElE,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,WAAW,UAAU;AAAA,IAClC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,KAAK,IAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACpC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,iBAAiB,IAAI,aAAa,IAAI,iBAAiB,KAAK;AAAA,IAC5D,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,EAC5C,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE5E,QAAM,QAAQ,OAAO;AACrB,QAAM,MAAM,SAAS,MAAM,OAAO,IAAI;AACtC,QAAM,qBAAqB,MAAM,YAAY;AAC7C,QAAM,8BAA8B,sBAAsB,mBAAmB,YAAY,MAAM,QAAQ,OAAO;AAC9G,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,kBAAkB,gBAAgB,CAAC,+BAA+B,MAAM,SAAS;AACvF,MAAI,WAAW,kBAAkB,OAAO,mBAAmB,cAAc,6BAA6B,YAAY;AAClH,QAAM,SAAS,MAAM,UAAU;AAC/B,QAAM,kBAAkB,kBAAkB,MAAM,eAAe,MAAM,QAAQ,WAAW;AAExF,MAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,gBAAgB,KAAK,QAAQ;AACjE,QAAI,YAAY;AAChB,QAAI,CAAC,cAAc;AACjB,UAAI,aAA8B;AAClC,UAAI;AACF,cAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,qBAAa,MAAM,QAAQ,MAAM,UAAU,IAAI,MAAM,aAAa;AAAA,MACpE,QAAQ;AAAA,MAAC;AACT,YAAM,aAAa,aAAa,IAAI,IAAI,UAAU,IAAI,oBAAI,IAAY;AACtE,kBAAY,IAAI,OAAO,CAAC,OAAO,WAAW,IAAI,EAAE,CAAC;AAAA,IACnD;AACA,QAAI,UAAU,QAAQ;AACpB,YAAM,aAA6B,MAAM;AAAA,QACvC;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,UAAU,GAAG,WAAW,KAAK;AAAA,QAC1C,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,QACvB,EAAE,UAAU,cAAc,gBAAgB,KAAK;AAAA,MACjD;AACA,YAAM,mBAAmB,oBAAI,IAAY;AACzC,iBAAW,OAAO,YAAY;AAC5B,cAAM,cAAc,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,EAAE,IAAI;AAC/D,YAAI,YAAa,kBAAiB,IAAI,WAAW;AAAA,MACnD;AACA,UAAI,iBAAiB,SAAS,GAAG;AAC/B,cAAM,oBAAoB,MAAM,KAAK,gBAAgB,EAAE,CAAC,KAAK;AAC7D,YAAI;AACF,qBAAW,MAAM,uBAAuB,EAAE,MAAM,UAAU,GAAG,iBAAiB;AAAA,QAChF,SAAS,OAAO;AACd,cAAI,gBAAgB,KAAK,GAAG;AAC1B,mBAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,UAC/D;AACA,gBAAM;AAAA,QACR;AAAA,MACF,WAAW,iBAAiB,OAAO,GAAG;AACpC,eAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,CAAC,UAAU;AACjC,UAAM,kBAAkB,oBAAI,IAAY;AACxC,UAAM,cAAc,mCAAmC,GAAG;AAC1D,UAAM,uBAAuB,eAAe,CAAC,4BAA4B,WAAW,IAAI,cAAc;AACtG,QAAI,qBAAsB,iBAAgB,IAAI,oBAAoB;AAClE,QAAI,KAAK,MAAO,iBAAgB,IAAI,KAAK,KAAK;AAE9C,QAAI;AACF,YAAM,QAAQ,MAAM,mCAAmC;AAAA,QACrD;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,YAAY,wBAAwB;AAAA,MACtC,CAAC;AACD,UAAI,MAAM,WAAY,iBAAgB,IAAI,MAAM,UAAU;AAC1D,UAAI,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,QAAQ;AAC5D,wBAAgB,IAAI,MAAM,UAAU,CAAC,CAAE;AAAA,MACzC;AACA,UAAI,MAAM,QAAQ,MAAM,UAAU,KAAK,MAAM,WAAW,QAAQ;AAC9D,wBAAgB,IAAI,MAAM,WAAW,CAAC,CAAE;AAAA,MAC1C;AAAA,IACF,QAAQ;AAAA,IAAC;AAET,eAAW,SAAS,iBAAiB;AACnC,UAAI,CAAC,MAAO;AACZ,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,WAAW,KAAK;AAAA,QAC7B,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,QACvB,EAAE,UAAU,cAAc,gBAAgB,MAAM;AAAA,MAClD;AACA,UAAI,KAAK,UAAU,IAAI,OAAO,IAAI;AAChC,mBAAW,SAAS,IAAI,OAAO,EAAE;AACjC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,CAAC,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AAEA,MAAI,MAAM,SAAS,WAAW;AAC5B,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AACA,UAAM,QAAmC,EAAE,QAAQ,UAAU,WAAW,KAAK;AAC7E,QAAI,WAAW,SAAU,OAAM,WAAW;AAC1C,QAAI,WAAW,WAAY,OAAM,WAAW;AAC5C,QAAI,WAAW,SAAS,CAAC,gBAAiB,OAAM,WAAW;AAC3D,QAAI,IAAK,OAAM,KAAK,EAAE,KAAK,IAAI;AAC/B,UAAMA,QAAO,MAAM,GAAG,KAAK,cAAc,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC;AAC5E,UAAMC,SAAQD,MAAK,IAAI,CAAC,SAAS;AAAA,MAC/B,IAAI,SAAS,IAAI,EAAE;AAAA,MACnB,MAAM,IAAI;AAAA,MACV,SAAS,IAAI,WAAW;AAAA,MACxB,UAAU,IAAI,YAAY;AAAA,MAC1B;AAAA,MACA,UAAU,CAAC,CAAC,IAAI;AAAA,MAChB,OAAO,IAAI,SAAS;AAAA,MACpB,UAAU,IAAI,YAAY,SAAS,IAAI,EAAE;AAAA,IAC3C,EAAE;AACF,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAAC;AAAA,MACA,SAAS;AAAA,MACT,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,MACA,YAAY,OAAO,IAAI,WAAW,IAAI,cAAc;AAAA,IACtD,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAAA,OAAM,CAAC;AAAA,EACpC;AAEA,MAAI,MAAM,SAAS,QAAQ;AACzB,QAAI,CAAC,UAAU;AACb,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzF;AACA,UAAMC,iBAA2C,EAAE,QAAQ,UAAU,WAAW,KAAK;AACrF,UAAMF,QAAO,MAAM,GAAG,KAAK,cAAcE,gBAAe,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC;AACpF,UAAMC,aAAY,iCAAiCH,OAAM,QAAQ;AACjE,UAAM,UAAU,oBAAI,IAAsE;AAC1F,UAAM,QAAoB,CAAC;AAC3B,eAAW,QAAQG,WAAU,SAAS;AACpC,YAAM,WAAqB;AAAA,QACzB,IAAI,KAAK;AAAA,QACT,MAAM,KAAK;AAAA,QACX,UAAU,KAAK;AAAA,QACf,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,UAAU,KAAK;AAAA,QACf,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,CAAC;AAAA,MACb;AACA,cAAQ,IAAI,KAAK,IAAI,EAAE,MAAM,UAAU,SAAS,SAAS,CAAC;AAC1D,UAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,QAAQ,GAAG;AAC/C,cAAM,cAAc,QAAQ,IAAI,KAAK,QAAQ;AAC7C,oBAAY,SAAS,KAAK,QAAQ;AAAA,MACpC,OAAO;AACL,cAAM,KAAK,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAO;AAAA,MACP,SAAS;AAAA,MACT,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,MAAM,CAAC;AAAA,EAC3C;AAEA,MAAI,MAAM,SAAS,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzD;AAEA,MAAI,iBAAiB;AAEnB,UAAMC,WAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvD,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,WAAW,KAAK;AAAA,MAClB,EAAE,SAAS,EAAE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE;AAAA,MACjD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,UAAM,WAAW,oBAAI,IAA4B;AACjD,eAAW,OAAO,SAAS;AACzB,YAAM,eAAe,IAAI;AACzB,YAAM,MAAM,eAAe,SAAS,aAAa,EAAE,IAAI;AACvD,UAAI,CAAC,IAAK;AACV,UAAI,CAAC,SAAS,IAAI,GAAG,EAAG,UAAS,IAAI,KAAK,CAAC,CAAC;AAC5C,eAAS,IAAI,GAAG,EAAG,KAAK,GAAG;AAAA,IAC7B;AAEA,UAAMC,eAAc,oBAAI,IAA2B;AACnD,UAAMC,oBAAmB,oBAAI,IAA2B;AACxD,UAAMC,kBAAiB,oBAAI,IAA2B;AACtD,eAAW,OAAO,SAAS;AACzB,MAAAF,aAAY,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI;AAChD,MAAAC,kBAAiB,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI,IAAI;AACvG,MAAAC,gBAAe,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,WAAW,IAAI;AAAA,IACxD;AAEA,UAAM,YAAY,MAAM,KAAK,SAAS,KAAK,CAAC;AAC5C,UAAM,UAAU,UAAU,SACtB,MAAM,GAAG,KAAK,QAAQ,EAAE,IAAI,EAAE,KAAK,UAAiC,EAAE,CAAC,IACvE,CAAC;AACL,UAAM,gBAAgB,QAAQ,OAA+B,CAAC,KAAK,WAAW;AAC5E,YAAM,MAAM,SAAS,OAAO,EAAE;AAC9B,YAAM,OAAO,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO;AACvF,UAAI,GAAG,IAAI;AACX,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AAEL,UAAM,cAAc,oBAAI,IAA+B;AACvD,UAAM,eAA4E,CAAC;AACnF,eAAW,CAAC,KAAKP,KAAI,KAAK,SAAS,QAAQ,GAAG;AAC5C,YAAMG,aAAY,iCAAiCH,OAAM,GAAG;AAC5D,kBAAY,IAAI,KAAKG,UAAS;AAC9B,iBAAW,QAAQA,WAAU,SAAS;AACpC,qBAAa,KAAK,EAAE,UAAU,KAAK,KAAK,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAIK,QAAO;AACX,QAAI,MAAM,WAAW,UAAU;AAC7B,MAAAA,QAAOA,MAAK,OAAO,CAAC,UAAU,MAAM,KAAK,QAAQ;AAAA,IACnD,WAAW,MAAM,WAAW,YAAY;AACtC,MAAAA,QAAOA,MAAK,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ;AAAA,IACpD;AAEA,QAAIJ,SAAQ;AACV,MAAAI,QAAOA,MAAK,OAAO,CAAC,EAAE,KAAK,MAAM;AAC/B,cAAM,aAAa,KAAK,aAAa,IAAI,YAAY;AACrD,eAAO,KAAK,KAAK,YAAY,EAAE,SAASJ,OAAM,KAAK,UAAU,SAASA,OAAM;AAAA,MAC9E,CAAC;AAAA,IACH;AACA,QAAI,KAAK;AACP,YAAM,QAAQ,IAAI,IAAI,GAAG;AACzB,MAAAI,QAAOA,MAAK,OAAO,CAAC,EAAE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;AAAA,IACrD;AAEA,IAAAA,MAAK,KAAK,CAAC,GAAG,MAAM;AAClB,YAAM,QAAQ,cAAc,EAAE,QAAQ,KAAK,EAAE;AAC7C,YAAM,QAAQ,cAAc,EAAE,QAAQ,KAAK,EAAE;AAC7C,YAAM,gBAAgB,MAAM,cAAc,KAAK;AAC/C,UAAI,kBAAkB,EAAG,QAAO;AAChC,aAAO,EAAE,KAAK,UAAU,cAAc,EAAE,KAAK,SAAS;AAAA,IACxD,CAAC;AAED,UAAMC,SAAQD,MAAK;AACnB,UAAME,YAAW,MAAM;AACvB,UAAMC,QAAO,MAAM;AACnB,UAAMC,UAASD,QAAO,KAAKD;AAC3B,UAAMG,SAAQL,MAAK,MAAMI,QAAOA,SAAQF,SAAQ;AAChD,UAAMI,aAAsB,CAAC;AAC7B,UAAMC,oBAAkD,CAAC;AACzD,UAAMC,0BAAwD,CAAC;AAC/D,eAAW,SAASH,QAAO;AACzB,YAAM,WAAW,OAAO,MAAM,KAAK,EAAE;AACrC,MAAAC,WAAU,KAAK,QAAQ;AACvB,MAAAC,kBAAiB,QAAQ,IAAI,MAAM;AACnC,MAAAC,wBAAuB,QAAQ,IAAI;AAAA,IACrC;AACA,UAAM,kBAAkB,MAAM,KAAK,IAAI,IAAIF,WAAU,IAAI,CAAC,OAAOC,kBAAiB,EAAE,CAAC,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC,CAAC;AACzK,UAAME,WAAUH,WAAU,SACtB,MAAM,sBAAsB;AAAA,MAC1B;AAAA,MACA,UAAU,EAAE,UAAU;AAAA,MACtB,WAAAA;AAAA,MACA,kBAAAC;AAAA,MACA,wBAAAC;AAAA,MACA;AAAA,IACF,CAAC,IACD,CAAC;AACL,UAAMf,SAAQY,OAAM,IAAI,CAAC,EAAE,UAAU,KAAK,KAAK,MAAM;AACnD,YAAMV,aAAY,YAAY,IAAI,GAAG;AACrC,YAAM,aAAa,KAAK,YAAYA,aAAYA,WAAU,IAAI,IAAI,KAAK,QAAQ,GAAG,QAAQ,OAAO;AACjG,YAAM,YAAY,KAAK,aAAa,KAAK;AACzC,YAAM,WAAW,OAAO,KAAK,EAAE;AAC/B,aAAO;AAAA,QACL,IAAI,KAAK;AAAA,QACT,MAAM,KAAK;AAAA,QACX,MAAME,aAAY,IAAI,QAAQ,KAAK;AAAA,QACnC,WAAWC,kBAAiB,IAAI,QAAQ,KAAK;AAAA,QAC7C,SAASC,gBAAe,IAAI,QAAQ,KAAK;AAAA,QACzC,UAAU;AAAA,QACV,YAAY,cAAc,GAAG,KAAK;AAAA,QAClC,UAAU,KAAK;AAAA,QACf;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU,KAAK;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,eAAe,KAAK,SAAS;AAAA,QAC7B,kBAAkB,KAAK,cAAc;AAAA,QACrC,UAAU,KAAK;AAAA,QACf,GAAIU,SAAQ,QAAQ,KAAK,CAAC;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,UAAMC,cAAa,KAAK,IAAI,GAAG,KAAK,KAAKT,SAAQC,SAAQ,CAAC;AAC1D,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAAT;AAAA,MACA,SAAS;AAAA,MACT,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,UAAU;AAAA,MACV;AAAA,MACA,YAAY,OAAO,IAAI,WAAW,IAAI,cAAc;AAAA,IACtD,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAAA,QAAO,OAAAQ,QAAO,MAAAE,OAAM,UAAAD,WAAU,YAAAQ,aAAY,aAAa,CAAC;AAAA,EACrF;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AAEA,QAAM,gBAA2C,EAAE,QAAQ,UAAU,WAAW,KAAK;AACrF,QAAM,OAAO,MAAM,GAAG,KAAK,cAAc,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC;AACpF,QAAM,YAAY,iCAAiC,MAAM,QAAQ;AACjE,QAAM,cAAc,oBAAI,IAA2B;AACnD,QAAM,iBAAiB,oBAAI,IAA2B;AACtD,QAAM,mBAAmB,oBAAI,IAA2B;AACxD,aAAW,OAAO,MAAM;AACtB,gBAAY,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,QAAQ,IAAI;AAChD,mBAAe,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,WAAW,IAAI;AACtD,qBAAiB,IAAI,OAAO,IAAI,EAAE,GAAG,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI,IAAI;AAAA,EACzG;AAGA,QAAM,UAAU,MAAM,UAAU,IAAI,KAAK,EAAE,YAAY;AACvD,MAAI,OAAO,UAAU;AACrB,MAAI,WAAW,UAAU;AACvB,WAAO,KAAK,OAAO,CAAC,SAAS,KAAK,QAAQ;AAAA,EAC5C,WAAW,WAAW,YAAY;AAChC,WAAO,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ;AAAA,EAC7C;AAEA,MAAI,QAAQ;AACV,WAAO,KAAK,OAAO,CAAC,SAAS;AAC3B,YAAM,aAAa,KAAK,aAAa,IAAI,YAAY;AACrD,aAAO,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM,KAAK,UAAU,SAAS,MAAM;AAAA,IAC9E,CAAC;AAAA,EACH;AACA,MAAI,KAAK;AACP,UAAM,QAAQ,IAAI,IAAI,GAAG;AACzB,WAAO,KAAK,OAAO,CAAC,SAAS,MAAM,IAAI,KAAK,EAAE,CAAC;AAAA,EACjD;AAEA,QAAM,QAAQ,KAAK;AACnB,QAAM,WAAW,MAAM;AACvB,QAAM,OAAO,MAAM;AACnB,QAAM,SAAS,OAAO,KAAK;AAC3B,QAAM,QAAQ,KAAK,MAAM,OAAO,QAAQ,QAAQ;AAChD,QAAM,YAAsB,CAAC;AAC7B,QAAM,mBAAkD,CAAC;AACzD,QAAM,yBAAwD,CAAC;AAC/D,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,OAAO,KAAK,EAAE;AAC/B,cAAU,KAAK,QAAQ;AACvB,qBAAiB,QAAQ,IAAI,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACrE,2BAAuB,QAAQ,IAAI;AAAA,EACrC;AACA,QAAM,UAAU,UAAU,SACtB,MAAM,sBAAsB;AAAA,IAC1B;AAAA,IACA,UAAU,EAAE,UAAU;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,WAAW,CAAC,QAAQ,IAAI,CAAC;AAAA,EAC5C,CAAC,IACD,CAAC;AACL,MAAI,aAA4B;AAChC,MAAI,gBAAgB,UAAU;AAC5B,UAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,SAAS,CAAC;AACxD,QAAI,QAAQ;AACV,YAAM,UAAU,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,SAAS,OAAO,EAAE;AAC5G,mBAAa;AAAA,IACf;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,IAAI,CAAC,SAAS;AAChC,UAAM,aAAa,KAAK,WAAW,UAAU,IAAI,IAAI,KAAK,QAAQ,GAAG,QAAQ,OAAO;AACpF,UAAM,YAAY,KAAK,aAAa,KAAK;AACzC,UAAM,WAAW,OAAO,KAAK,EAAE;AAC/B,WAAO;AAAA,MACL,IAAI,KAAK;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,YAAY,IAAI,QAAQ,KAAK;AAAA,MACnC,SAAS,eAAe,IAAI,QAAQ,KAAK;AAAA,MACzC,WAAW,iBAAiB,IAAI,QAAQ,KAAK;AAAA,MAC7C,UAAU,KAAK;AAAA,MACf;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,UAAU,KAAK;AAAA,MACf;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,eAAe,KAAK;AAAA,MACpB,eAAe,KAAK,SAAS;AAAA,MAC7B,kBAAkB,KAAK,cAAc;AAAA,MACrC,UAAU,KAAK;AAAA,MACf,GAAI,QAAQ,QAAQ,KAAK,CAAC;AAAA,IAC5B;AAAA,EACF,CAAC;AACD,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAC1D,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA,YAAY,OAAO,IAAI,WAAW,IAAI,cAAc;AAAA,EACtD,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,UAAU,YAAY,aAAa,CAAC;AACrF;AAEO,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,mCAAmC,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,+BAA+B;AAAA,EAClH;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,qBAAqB;AAAA,IAC1F,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEA,MAAM,uBAAyC;AAAA,EAC7C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,iCAAiC;AAAA,EAChG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,qBAAqB;AAAA,EAC7G;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,kBAAkB;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,qBAAqB;AAAA,EAC7G;AACF;AAEA,MAAM,yBAA2C;AAAA,EAC/C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,YAAY;AAAA,EACnB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,kBAAkB;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,qBAAqB;AAAA,EAC7G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
   "names": ["orgs", "items", "orgListFilter", "hierarchy", "search", "slugByOrgId", "updatedAtByOrgId", "logoUrlByOrgId", "rows", "total", "pageSize", "page", "start", "paged", "recordIds", "tenantIdByRecord", "organizationIdByRecord", "cfByOrg", "totalPages"]
 }

package/dist/modules/entities/api/definitions.js

@@ -360,6 +360,8 @@ async function GET(req) {
         // attachments config passthrough
         maxAttachmentSizeMb: typeof d.configJson?.maxAttachmentSizeMb === "number" ? d.configJson.maxAttachmentSizeMb : void 0,
         acceptExtensions: Array.isArray(d.configJson?.acceptExtensions) ? d.configJson.acceptExtensions : void 0,
+        // phone config passthrough
+        defaultCountryIso2: typeof d.configJson?.defaultCountryIso2 === "string" ? d.configJson.defaultCountryIso2 : void 0,
         entityId,
         fieldset: normalizedFieldset ?? effectiveFieldsets[0],
         fieldsets: effectiveFieldsets.length > 0 ? effectiveFieldsets : void 0,

package/dist/modules/entities/api/definitions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/definitions.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomEntity, CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertCustomFieldDefSchema, fieldsetCodeRegex } from '@open-mercato/core/modules/entities/data/validators'\nimport {\n  createDefinitionsCacheKey,\n  createDefinitionsCacheTags,\n  invalidateDefinitionsCache,\n  ENTITY_DEFINITIONS_CACHE_TTL_MS,\n} from './definitions.cache'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { filterSelectableSystemEntityIds, isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/system-entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadEntityFieldsetConfigs, CustomFieldsetDefinition } from '../lib/fieldsets'\nimport { installCustomEntitiesFromModules } from '../lib/install-from-ce'\nimport { normalizeCustomFieldOptions } from '@open-mercato/shared/modules/entities/options'\nimport { CURRENCY_OPTIONS_URL } from '@open-mercato/shared/modules/entities/kinds'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  beginEntitiesMutationGuard,\n  FIELD_DEFINITION_RESOURCE_KIND,\n} from './definitions.mutation-guard'\nimport {\n  createExactDefinitionWhere,\n  createScopedDefinitionTombstone,\n  createVisibleDefinitionWhere,\n  markDefinitionTombstoned,\n  resolveDefinitionScopeFromOrganizationScope,\n  resolveDefinitionMutationScope,\n  selectVisibleDefinitionWinner,\n} from '../lib/definition-scope'\nimport { resolveEntityDefinitionsVersion } from '../lib/definitions-version'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('entities').child({ component: 'definitions' })\n\n/**\n * Validate defaultValue against the field kind. Returns an error message string\n * if invalid, or null if valid. For dictionary and currency kinds, queries the\n * database to verify the token exists.\n */\nasync function validateDefaultValueByKind(\n  value: unknown,\n  kind: string,\n  cfg: Record<string, unknown>,\n  em: EntityManager,\n  tenantContext: { tenantId: string | null; organizationId: string | null },\n): Promise<string | null> {\n  switch (kind) {\n    case 'boolean':\n      if (typeof value !== 'boolean') return 'defaultValue for boolean fields must be true or false'\n      return null\n    case 'integer':\n      if (typeof value !== 'number' || !Number.isInteger(value))\n        return 'defaultValue for integer fields must be a whole number'\n      return null\n    case 'float':\n      if (typeof value !== 'number' || !isFinite(value))\n        return 'defaultValue for float fields must be a finite number'\n      return null\n    case 'text':\n    case 'multiline':\n    case 'date':\n    case 'datetime':\n      if (typeof value !== 'string')\n        return `defaultValue for ${kind} fields must be a string`\n      return null\n    case 'dictionary': {\n      if (typeof value !== 'string')\n        return 'defaultValue for dictionary fields must be a string'\n      const dictionaryId = typeof cfg.dictionaryId === 'string' ? cfg.dictionaryId.trim() : ''\n      if (dictionaryId) {\n        try {\n          const { DictionaryEntry } = await import('@open-mercato/core/modules/dictionaries/data/entities')\n          const entry = await em.findOne(DictionaryEntry, {\n            dictionary: dictionaryId,\n            value: value,\n            ...(tenantContext.organizationId ? { organizationId: tenantContext.organizationId } : {}),\n            ...(tenantContext.tenantId ? { tenantId: tenantContext.tenantId } : {}),\n          })\n          if (!entry) return `defaultValue \"${value}\" does not match any entry in the configured dictionary`\n        } catch (err) {\n          // If the dictionaries module is not available, skip entry validation\n          logger.debug('Dictionary validation skipped \u2014 module not available', { err })\n        }\n      }\n      return null\n    }\n    case 'currency': {\n      if (typeof value !== 'string')\n        return 'defaultValue for currency fields must be a string'\n      try {\n        const { Currency } = await import('@open-mercato/core/modules/currencies/data/entities')\n        const where: Record<string, string> = { code: value as string }\n        if (tenantContext.tenantId) where.tenantId = tenantContext.tenantId\n        if (tenantContext.organizationId) where.organizationId = tenantContext.organizationId\n        const currency = await em.findOne(Currency, where)\n        if (!currency) return `defaultValue \"${value}\" does not match any available currency`\n      } catch (err) {\n        // If the currencies module is not available, skip currency validation\n        logger.debug('Currency validation skipped \u2014 module not available', { err })\n      }\n      return null\n    }\n    case 'select': {\n      if (typeof value !== 'string' && typeof value !== 'number')\n        return 'defaultValue for select fields must be a string or number'\n      const options = normalizeCustomFieldOptions(\n        Array.isArray(cfg.options) ? cfg.options : [],\n      )\n      if (options.length > 0) {\n        const match = options.some(\n          (o) => o.value === value || String(o.value) === String(value),\n        )\n        if (!match) return 'defaultValue does not match any of the configured options'\n      }\n      return null\n    }\n    case 'relation':\n    case 'attachment':\n      return `defaultValue is not supported for ${kind} fields`\n    default:\n      return null\n  }\n}\n\n/**\n * Normalize defaultValue to the canonical storage shape for the given kind.\n */\nfunction normalizeDefaultValueByKind(value: unknown, kind: string): unknown {\n  switch (kind) {\n    case 'boolean':\n      return value === true\n    case 'integer':\n      return Math.round(Number(value))\n    case 'float':\n      return Number(value)\n    default:\n      return value\n  }\n}\n\nexport const metadata = {\n  // Reading definitions is needed by record forms; keep it auth-protected but accessible to all authenticated users\n  GET: { requireAuth: true },\n  // Mutations remain admin-only\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction parseEntityIds(url: URL): string[] {\n  const direct = url.searchParams.getAll('entityId').filter((id) => typeof id === 'string' && id.trim().length > 0)\n  const combined = url.searchParams.get('entityIds')\n  if (combined) {\n    combined\n      .split(',')\n      .map((id) => id.trim())\n      .filter((id) => id.length > 0)\n      .forEach((id) => direct.push(id))\n  }\n  const unique: string[] = []\n  const seen = new Set<string>()\n  for (const id of direct) {\n    if (seen.has(id)) continue\n    seen.add(id)\n    unique.push(id)\n  }\n  return unique\n}\n\nasync function resolveEntityDefaultEditor(em: any, entityId: string, tenantId: string | null | undefined): Promise<string | undefined> {\n  try {\n    const ent = await em.findOne(CustomEntity, {\n      entityId,\n      $and: [\n        { $or: [ { tenantId: tenantId ?? undefined as any }, { tenantId: null } ] },\n      ],\n    } as any)\n    if (ent && typeof (ent as any).defaultEditor === 'string') return (ent as any).defaultEditor\n  } catch {}\n  return undefined\n}\n\nfunction normalizeFieldGroup(raw: unknown): { code: string; title?: string; hint?: string } | undefined {\n  if (!raw) return undefined\n  if (typeof raw === 'string') {\n    const code = raw.trim()\n    return code ? { code } : undefined\n  }\n  if (typeof raw !== 'object') return undefined\n  const entry = raw as Record<string, unknown>\n  const code = typeof entry.code === 'string' ? entry.code.trim() : ''\n  if (!code) return undefined\n  const group: { code: string; title?: string; hint?: string } = { code }\n  if (typeof entry.title === 'string' && entry.title.trim()) group.title = entry.title.trim()\n  if (typeof entry.hint === 'string' && entry.hint.trim()) group.hint = entry.hint.trim()\n  return group\n}\n\nfunction definitionMatchesReadScope(\n  definition: { tenantId?: string | null; organizationId?: string | null },\n  scope: { tenantId: string | null; organizationId: string | null },\n) {\n  const definitionTenantId = definition.tenantId ?? null\n  const definitionOrganizationId = definition.organizationId ?? null\n  const tenantMatches = definitionTenantId === null || definitionTenantId === scope.tenantId\n  const organizationMatches =\n    definitionOrganizationId === null ||\n    (scope.organizationId !== null && definitionOrganizationId === scope.organizationId)\n  return tenantMatches && organizationMatches\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const requestedEntityIds = parseEntityIds(url)\n  if (!requestedEntityIds.length) {\n    return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  }\n  const requestedFieldset = url.searchParams.get('fieldset')\n  const fieldsetFilter = requestedFieldset && requestedFieldset.trim().length ? requestedFieldset.trim() : null\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const entityIds = filterSelectableSystemEntityIds(requestedEntityIds)\n  if (!entityIds.length) {\n    return NextResponse.json({ items: [] })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const definitionScope = resolveDefinitionScopeFromOrganizationScope(auth, scope)\n  const tenantId = definitionScope.tenantId\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = definitionScope.organizationId\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n\n  let canManageDefinitions = false\n  if (typeof auth.sub === 'string' && auth.sub.length > 0) {\n    try {\n      const rbac = resolve('rbacService') as RbacService\n      canManageDefinitions = await rbac.userHasAllFeatures(auth.sub, ['entities.definitions.manage'], {\n        tenantId,\n        organizationId,\n      })\n    } catch {\n      // RBAC service unavailable \u2014 fall back to read-only (no definition sync)\n    }\n  }\n\n  if (canManageDefinitions) {\n    try {\n      await installCustomEntitiesFromModules(em, cache, {\n        tenantIds: [tenantId],\n        entityIds,\n        includeGlobal: true,\n        createOnly: true,\n      })\n    } catch (err) {\n      logger.warn('Failed to synchronize module-backed definitions', {\n        tenantId,\n        entityIds,\n        err,\n      })\n    }\n  }\n\n  let cacheKey: string | null = null\n  if (cache && !fieldsetFilter) {\n    cacheKey = createDefinitionsCacheKey({\n      tenantId,\n      organizationId,\n      entityIds,\n    })\n    try {\n      const cached = await cache.get(cacheKey)\n      if (cached) {\n        return NextResponse.json(cached)\n      }\n    } catch (err) {\n      logger.warn('Failed to read cache', { err })\n    }\n  }\n\n  const fieldsetConfigs = await loadEntityFieldsetConfigs(em, {\n    entityIds,\n    tenantId,\n    organizationId,\n    mode: 'public',\n  })\n\n  const tenantCandidates = [{ tenantId }, { tenantId: null as string | null }]\n  const organizationCandidates = [{ organizationId: null as string | null }]\n  if (organizationId) organizationCandidates.unshift({ organizationId })\n  const readScope = { tenantId, organizationId }\n\n  const whereActive = {\n    entityId: { $in: entityIds as any },\n    deletedAt: null,\n    $and: [\n      { $or: tenantCandidates },\n      { $or: organizationCandidates },\n    ],\n  } as any\n  const defs = (await em.find(CustomFieldDef, whereActive as any))\n    .filter((definition: any) => definitionMatchesReadScope(definition, readScope))\n  const tombstones = (await em.find(CustomFieldDef, {\n    entityId: { $in: entityIds as any },\n    deletedAt: { $ne: null } as any,\n    $and: [\n      { $or: tenantCandidates },\n      { $or: organizationCandidates },\n    ],\n  } as any)).filter((definition: any) => definitionMatchesReadScope(definition, readScope))\n\n  const tombstonedByEntity = new Map<string, Set<string>>()\n  for (const entry of tombstones as any[]) {\n    const eid = String(entry.entityId)\n    if (!tombstonedByEntity.has(eid)) tombstonedByEntity.set(eid, new Set())\n    tombstonedByEntity.get(eid)!.add(entry.key)\n  }\n\n  const scopeScore = (x: any) => (x.tenantId ? 2 : 0) + (x.organizationId ? 1 : 0)\n\n  const definitionsByEntity = new Map<string, any[]>()\n  for (const d of defs) {\n    const eid = String(d.entityId)\n    if (!definitionsByEntity.has(eid)) definitionsByEntity.set(eid, [])\n    definitionsByEntity.get(eid)!.push(d)\n  }\n\n  const entityDefaultEditors = new Map<string, string | undefined>()\n  for (const entityId of entityIds) {\n    const editor = await resolveEntityDefaultEditor(em, entityId, tenantId ?? null)\n    entityDefaultEditors.set(entityId, editor)\n  }\n\n  const items: any[] = []\n\n  const entityOrder = new Map<string, number>()\n  entityIds.forEach((id, idx) => entityOrder.set(id, idx))\n\n  for (const entityId of entityIds) {\n    const defsForEntity = definitionsByEntity.get(entityId) ?? []\n    if (!defsForEntity.length) continue\n    const tombstonedKeys = tombstonedByEntity.get(entityId) ?? new Set<string>()\n    const byKey = new Map<string, any>()\n    for (const d of defsForEntity) {\n      const existing = byKey.get(d.key)\n      if (!existing) { byKey.set(d.key, d); continue }\n      const sNew = scopeScore(d)\n      const sOld = scopeScore(existing)\n      if (sNew > sOld) { byKey.set(d.key, d); continue }\n      if (sNew < sOld) continue\n      const tNew = (d.updatedAt instanceof Date) ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const tOld = (existing.updatedAt instanceof Date) ? existing.updatedAt.getTime() : new Date(existing.updatedAt).getTime()\n      if (tNew >= tOld) byKey.set(d.key, d)\n    }\n\n    const defaultEditor = entityDefaultEditors.get(entityId)\n    const winning = Array.from(byKey.values()).filter((d: any) => (d.isActive !== false) && !tombstonedKeys.has(d.key))\n    winning.sort((a: any, b: any) => ((a.configJson?.priority ?? 0) - (b.configJson?.priority ?? 0)))\n\n    for (const d of winning) {\n      const rawFieldset = typeof d.configJson?.fieldset === 'string' ? d.configJson.fieldset.trim() : ''\n      const normalizedFieldset = rawFieldset.length > 0 ? rawFieldset : undefined\n      const normalizedFieldsets = Array.isArray(d.configJson?.fieldsets)\n        ? d.configJson.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const effectiveFieldsets = normalizedFieldsets.length > 0\n        ? normalizedFieldsets\n        : (normalizedFieldset ? [normalizedFieldset] : [])\n      if (fieldsetFilter && !effectiveFieldsets.includes(fieldsetFilter)) continue\n      const groupInfo = normalizeFieldGroup(d.configJson?.group)\n      const keyLower = String(d.key).toLowerCase()\n      const candidateBase = {\n        key: d.key,\n        kind: d.kind,\n        label: d.configJson?.label || d.key,\n        description: d.configJson?.description || undefined,\n        multi: Boolean(d.configJson?.multi),\n        options: (() => {\n          if (d.kind === 'currency') return undefined\n          const normalizedOptions = normalizeCustomFieldOptions(d.configJson?.options)\n          return normalizedOptions.length ? normalizedOptions : undefined\n        })(),\n        optionsUrl: (() => {\n          if (d.kind === 'currency') return CURRENCY_OPTIONS_URL\n          const dictionaryId = typeof d.configJson?.dictionaryId === 'string' ? d.configJson.dictionaryId : undefined\n          if (dictionaryId) return `/api/dictionaries/${dictionaryId}/entries`\n          return typeof d.configJson?.optionsUrl === 'string' ? d.configJson.optionsUrl : undefined\n        })(),\n        filterable: Boolean(d.configJson?.filterable),\n        formEditable: d.configJson?.formEditable !== undefined ? Boolean(d.configJson.formEditable) : true,\n        listVisible: d.configJson?.listVisible !== undefined ? Boolean(d.configJson.listVisible) : true,\n        editor: typeof d.configJson?.editor === 'string'\n          ? d.configJson.editor\n          : (d.kind === 'multiline' ? defaultEditor : undefined),\n        input: typeof d.configJson?.input === 'string' ? d.configJson.input : undefined,\n        dictionaryId: typeof d.configJson?.dictionaryId === 'string' ? d.configJson.dictionaryId : undefined,\n        dictionaryInlineCreate: d.configJson?.dictionaryInlineCreate !== undefined\n          ? Boolean(d.configJson.dictionaryInlineCreate)\n          : undefined,\n        priority: typeof d.configJson?.priority === 'number' ? d.configJson.priority : 0,\n        validation: Array.isArray(d.configJson?.validation) ? d.configJson.validation : undefined,\n        defaultValue: d.configJson?.defaultValue !== undefined ? d.configJson.defaultValue : undefined,\n        // attachments config passthrough\n        maxAttachmentSizeMb: typeof d.configJson?.maxAttachmentSizeMb === 'number' ? d.configJson.maxAttachmentSizeMb : undefined,\n        acceptExtensions: Array.isArray(d.configJson?.acceptExtensions) ? d.configJson.acceptExtensions : undefined,\n        entityId,\n        fieldset: normalizedFieldset ?? effectiveFieldsets[0],\n        fieldsets: effectiveFieldsets.length > 0 ? effectiveFieldsets : undefined,\n        group: groupInfo,\n      } as any\n      const metrics = computeDefinitionScore(d, candidateBase, entityOrder.get(entityId) ?? Number.MAX_SAFE_INTEGER)\n      const candidate = { ...candidateBase, __score: metrics }\n      const existing = (items as any[]).find((entry) => entry.key.toLowerCase() === keyLower)\n      if (!existing) {\n        items.push(candidate)\n        continue\n      }\n      const existingScore = existing.__score as { base: number; penalty: number; entityIndex: number }\n      const candidateScoreInfo = candidate.__score as { base: number; penalty: number; entityIndex: number }\n      const better =\n        candidateScoreInfo.base > existingScore.base ||\n        (candidateScoreInfo.base === existingScore.base && candidateScoreInfo.penalty < existingScore.penalty) ||\n        (candidateScoreInfo.base === existingScore.base && candidateScoreInfo.penalty === existingScore.penalty && candidateScoreInfo.entityIndex < existingScore.entityIndex)\n      if (better) {\n        const index = items.findIndex((entry) => entry.key.toLowerCase() === keyLower)\n        if (index >= 0) items[index] = candidate\n      }\n    }\n  }\n\n  const sanitized = items.map((item: any) => {\n    const { __score, ...rest } = item\n    return rest\n  })\n  sanitized.sort((a: any, b: any) => ((a.priority ?? 0) - (b.priority ?? 0)))\n\n  const fieldsetsByEntity: Record<string, CustomFieldsetDefinition[]> = {}\n  const entitySettings: Record<string, { singleFieldsetPerRecord: boolean }> = {}\n  for (const entityId of entityIds) {\n    const cfg = fieldsetConfigs.get(entityId) ?? { fieldsets: [], singleFieldsetPerRecord: true }\n    fieldsetsByEntity[entityId] = cfg.fieldsets\n    entitySettings[entityId] = { singleFieldsetPerRecord: cfg.singleFieldsetPerRecord }\n  }\n\n  const responseBody = { items: sanitized, fieldsetsByEntity, entitySettings }\n\n  if (cache && cacheKey && !fieldsetFilter) {\n    const tags = createDefinitionsCacheTags({\n      tenantId,\n      organizationId,\n      entityIds,\n    })\n    try {\n      await cache.set(cacheKey, responseBody, {\n        ttl: ENTITY_DEFINITIONS_CACHE_TTL_MS,\n        tags,\n      })\n    } catch (err) {\n      logger.warn('Failed to store cache entry', { err })\n    }\n  }\n\n  return NextResponse.json(responseBody)\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = upsertCustomFieldDefSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const input = parsed.data\n\n  if (!isSystemEntitySelectable(input.entityId)) {\n    return NextResponse.json({ error: 'Custom fields are not supported for this entity' }, { status: 400 })\n  }\n\n  if (input.kind === 'dictionary') {\n    const dictionaryId = input.configJson?.dictionaryId\n    if (typeof dictionaryId !== 'string' || dictionaryId.trim().length === 0) {\n      return NextResponse.json({ error: 'dictionaryId is required for dictionary custom fields' }, { status: 400 })\n    }\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n\n  const where: any = createExactDefinitionWhere(input.entityId, input.key, scope)\n  let def = await em.findOne(CustomFieldDef, where)\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: FIELD_DEFINITION_RESOURCE_KIND,\n    resourceId: def ? def.id : `${input.entityId}:${input.key}`,\n    operation: def ? 'update' : 'create',\n    mutationPayload: input as unknown as Record<string, unknown>,\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  if (!def) def = em.create(CustomFieldDef, { ...where, createdAt: new Date() })\n  def.kind = input.kind\n  const inCfg = (input as any).configJson ?? {}\n  const cfg: Record<string, any> = { ...inCfg }\n  if (cfg.label == null || String(cfg.label).trim() === '') cfg.label = input.key\n  if (cfg.formEditable === undefined) cfg.formEditable = true\n  if (cfg.listVisible === undefined) cfg.listVisible = true\n  if (input.kind === 'dictionary') {\n    const dictionaryId = typeof cfg.dictionaryId === 'string' ? cfg.dictionaryId.trim() : ''\n    cfg.dictionaryId = dictionaryId\n    cfg.dictionaryInlineCreate = cfg.dictionaryInlineCreate !== false\n  }\n  if (input.kind === 'currency') {\n    cfg.optionsUrl = CURRENCY_OPTIONS_URL\n    if (Array.isArray(cfg.options)) delete cfg.options\n  }\n  if (input.kind === 'multiline' && (cfg.editor == null || String(cfg.editor).trim() === '')) {\n    cfg.editor = 'markdown'\n  }\n  // Validate and normalize defaultValue by kind before persisting\n  if (cfg.defaultValue !== undefined && cfg.defaultValue !== null) {\n    const validationError = await validateDefaultValueByKind(\n      cfg.defaultValue, input.kind, cfg, em,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n    if (validationError) {\n      return NextResponse.json({ error: validationError }, { status: 400 })\n    }\n    cfg.defaultValue = normalizeDefaultValueByKind(cfg.defaultValue, input.kind)\n  }\n  def.configJson = cfg\n  def.isActive = input.isActive ?? true\n  def.deletedAt = def.isActive === false ? (def.deletedAt ?? new Date()) : null\n  def.updatedAt = new Date()\n  em.persist(def)\n  await em.flush()\n  await guard.runAfterSuccess()\n  await invalidateDefinitionsCache(cache, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    entityIds: [input.entityId],\n  })\n  // Changing field definitions may impact forms but not sidebar items; no nav cache touch\n  return NextResponse.json({ ok: true, item: { id: def.id, key: def.key, kind: def.kind, configJson: def.configJson, isActive: def.isActive } })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const { entityId, key } = body || {}\n  if (!entityId || !key) return NextResponse.json({ error: 'entityId and key are required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n  const where: any = createExactDefinitionWhere(entityId, key, scope)\n  let def = await em.findOne(CustomFieldDef, where)\n  let inherited: any | null = null\n  if (!def) {\n    inherited = selectVisibleDefinitionWinner(await em.find(CustomFieldDef, createVisibleDefinitionWhere(\n      entityId,\n      key,\n      scope,\n      { deletedAt: null, isActive: true },\n    )))\n    if (!inherited) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: FIELD_DEFINITION_RESOURCE_KIND,\n    resourceId: def?.id ?? inherited?.id ?? `${entityId}:${key}`,\n    operation: 'delete',\n    mutationPayload: { entityId, key },\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  if (!def) {\n    def = createScopedDefinitionTombstone(em, inherited, scope)\n  } else {\n    markDefinitionTombstoned(def)\n  }\n  em.persist(def)\n  await em.flush()\n  await guard.runAfterSuccess()\n  await invalidateDefinitionsCache(cache, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    entityIds: [entityId],\n  })\n  // Changing field definitions may impact forms but not sidebar items; no nav cache touch\n  // Return the post-delete aggregate version so the edit form keeps its optimistic-lock\n  // token in sync after removing a field out-of-band (issue #3152).\n  const version = await resolveEntityDefinitionsVersion(em, {\n    entityId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  return NextResponse.json({ ok: true, version })\n}\n\nconst definitionsQuerySchema = z\n  .object({\n    entityId: z.union([z.string(), z.array(z.string())]).optional(),\n    entityIds: z.string().optional(),\n    fieldset: z.string().regex(fieldsetCodeRegex).optional(),\n  })\n  .refine(\n    (value) => {\n      if (value.entityId && typeof value.entityId === 'string' && value.entityId.trim().length > 0) return true\n      if (Array.isArray(value.entityId) && value.entityId.length > 0) return true\n      return typeof value.entityIds === 'string' && value.entityIds.trim().length > 0\n    },\n    { message: 'Provide at least one entityId or an entityIds list.' }\n  )\n\nconst customFieldOptionValueSchema = z.union([z.string(), z.number()])\n\nconst customFieldDefinitionSchema = z.object({\n  key: z.string(),\n  kind: z.string(),\n  label: z.string(),\n  description: z.string().optional(),\n  multi: z.boolean().optional(),\n  options: z.array(customFieldOptionValueSchema).optional(),\n  optionsUrl: z.string().optional(),\n  filterable: z.boolean().optional(),\n  formEditable: z.boolean().optional(),\n  listVisible: z.boolean().optional(),\n  editor: z.string().optional(),\n  input: z.string().optional(),\n  dictionaryId: z.string().optional(),\n  dictionaryInlineCreate: z.boolean().optional(),\n  priority: z.number().optional(),\n  validation: z.array(z.any()).optional(),\n  defaultValue: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),\n  maxAttachmentSizeMb: z.number().optional(),\n  acceptExtensions: z.array(z.any()).optional(),\n  entityId: z.string(),\n  fieldset: z.string().optional(),\n  group: z\n    .object({\n      code: z.string(),\n      title: z.string().optional(),\n      hint: z.string().optional(),\n    })\n    .optional(),\n})\n\nconst customFieldsetGroupResponseSchema = z.object({\n  code: z.string(),\n  title: z.string().optional(),\n  hint: z.string().optional(),\n})\n\nconst entityFieldsetResponseSchema = z.object({\n  code: z.string(),\n  label: z.string(),\n  icon: z.string().optional(),\n  description: z.string().optional(),\n  groups: z.array(customFieldsetGroupResponseSchema).optional(),\n})\n\nconst definitionsResponseSchema = z.object({\n  items: z.array(customFieldDefinitionSchema),\n  fieldsetsByEntity: z.record(z.string(), z.array(entityFieldsetResponseSchema)).optional(),\n  entitySettings: z\n    .record(\n      z.string(),\n      z.object({\n        singleFieldsetPerRecord: z.boolean().optional(),\n      })\n    )\n    .optional(),\n})\n\nconst upsertDefinitionResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string().uuid(),\n    key: z.string(),\n    kind: z.string(),\n    configJson: z.record(z.string(), z.any()),\n    isActive: z.boolean().optional(),\n  }),\n})\n\nconst deleteDefinitionRequestSchema = z.object({\n  entityId: z.string(),\n  key: z.string(),\n})\n\nconst deleteDefinitionResponseSchema = z.object({\n  ok: z.literal(true),\n  version: z.string().nullable().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage custom field definitions',\n  methods: {\n    GET: {\n      summary: 'List active custom field definitions',\n      description: 'Returns active custom field definitions for the supplied entity ids, respecting tenant scope and tombstones.',\n      query: definitionsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Definition list',\n          schema: definitionsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Upsert custom field definition',\n      description: 'Creates or updates a custom field definition for the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: upsertCustomFieldDefSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Definition saved',\n          schema: upsertDefinitionResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failed',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft delete custom field definition',\n      description: 'Marks the specified definition inactive and tombstones it for the current scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteDefinitionRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Definition deleted',\n          schema: deleteDefinitionResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or key',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\nconst computeDefinitionScore = (def: any, cfg: Record<string, any>, entityIndex: number) => {\n  const listVisibleScore = cfg.listVisible === false ? 0 : 1\n  const formEditableScore = cfg.formEditable === false ? 0 : 1\n  const filterableScore = cfg.filterable ? 1 : 0\n  const kindScore = (() => {\n    switch (def.kind) {\n      case 'dictionary':\n        return 8\n      case 'relation':\n        return 6\n      case 'select':\n      case 'currency':\n        return 4\n      case 'multiline':\n        return 3\n      case 'boolean':\n      case 'integer':\n      case 'float':\n        return 2\n      default:\n        return 1\n    }\n  })()\n  const optionsBonus = Array.isArray(cfg.options) && cfg.options.length ? 2 : 0\n  const dictionaryBonus = typeof cfg.dictionaryId === 'string' && cfg.dictionaryId.trim().length ? 5 : 0\n  const base = (listVisibleScore * 16) + (formEditableScore * 8) + (filterableScore * 4) + kindScore + optionsBonus + dictionaryBonus\n  const penalty = typeof cfg.priority === 'number' ? cfg.priority : 0\n  return { base, penalty, entityIndex }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,cAAc,sBAAsB;AAC7C,SAAS,4BAA4B,yBAAyB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,0CAA0C;AACnD,SAAS,iCAA2D;AACpE,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AAErC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAO1E,eAAe,2BACb,OACA,MACA,KACA,IACA,eACwB;AACxB,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,UAAI,OAAO,UAAU,UAAW,QAAO;AACvC,aAAO;AAAA,IACT,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK;AACtD,eAAO;AACT,aAAO;AAAA,IACT,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,CAAC,SAAS,KAAK;AAC9C,eAAO;AACT,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,OAAO,UAAU;AACnB,eAAO,oBAAoB,IAAI;AACjC,aAAO;AAAA,IACT,KAAK,cAAc;AACjB,UAAI,OAAO,UAAU;AACnB,eAAO;AACT,YAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,IAAI;AACtF,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,uDAAuD;AAChG,gBAAM,QAAQ,MAAM,GAAG,QAAQ,iBAAiB;AAAA,YAC9C,YAAY;AAAA,YACZ;AAAA,YACA,GAAI,cAAc,iBAAiB,EAAE,gBAAgB,cAAc,eAAe,IAAI,CAAC;AAAA,YACvF,GAAI,cAAc,WAAW,EAAE,UAAU,cAAc,SAAS,IAAI,CAAC;AAAA,UACvE,CAAC;AACD,cAAI,CAAC,MAAO,QAAO,iBAAiB,KAAK;AAAA,QAC3C,SAAS,KAAK;AAEZ,iBAAO,MAAM,6DAAwD,EAAE,IAAI,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,YAAY;AACf,UAAI,OAAO,UAAU;AACnB,eAAO;AACT,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qDAAqD;AACvF,cAAM,QAAgC,EAAE,MAAM,MAAgB;AAC9D,YAAI,cAAc,SAAU,OAAM,WAAW,cAAc;AAC3D,YAAI,cAAc,eAAgB,OAAM,iBAAiB,cAAc;AACvE,cAAM,WAAW,MAAM,GAAG,QAAQ,UAAU,KAAK;AACjD,YAAI,CAAC,SAAU,QAAO,iBAAiB,KAAK;AAAA,MAC9C,SAAS,KAAK;AAEZ,eAAO,MAAM,2DAAsD,EAAE,IAAI,CAAC;AAAA,MAC5E;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,UAAU;AACb,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU;AAChD,eAAO;AACT,YAAM,UAAU;AAAA,QACd,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,MAC9C;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,QAAQ,QAAQ;AAAA,UACpB,CAAC,MAAM,EAAE,UAAU,SAAS,OAAO,EAAE,KAAK,MAAM,OAAO,KAAK;AAAA,QAC9D;AACA,YAAI,CAAC,MAAO,QAAO;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AACH,aAAO,qCAAqC,IAAI;AAAA,IAClD;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,4BAA4B,OAAgB,MAAuB;AAC1E,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,UAAU;AAAA,IACnB,KAAK;AACH,aAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO;AAAA,EACX;AACF;AAEO,MAAM,WAAW;AAAA;AAAA,EAEtB,KAAK,EAAE,aAAa,KAAK;AAAA;AAAA,EAEzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEA,SAAS,eAAe,KAAoB;AAC1C,QAAM,SAAS,IAAI,aAAa,OAAO,UAAU,EAAE,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,CAAC;AAChH,QAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AACjD,MAAI,UAAU;AACZ,aACG,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,EAC5B,QAAQ,CAAC,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,EACpC;AACA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,MAAM,QAAQ;AACvB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,WAAO,KAAK,EAAE;AAAA,EAChB;AACA,SAAO;AACT;AAEA,eAAe,2BAA2B,IAAS,UAAkB,UAAkE;AACrI,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAc;AAAA,MACzC;AAAA,MACA,MAAM;AAAA,QACJ,EAAE,KAAK,CAAE,EAAE,UAAU,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,MAC5E;AAAA,IACF,CAAQ;AACR,QAAI,OAAO,OAAQ,IAAY,kBAAkB,SAAU,QAAQ,IAAY;AAAA,EACjF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEA,SAAS,oBAAoB,KAA2E;AACtG,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAMA,QAAO,IAAI,KAAK;AACtB,WAAOA,QAAO,EAAE,MAAAA,MAAK,IAAI;AAAA,EAC3B;AACA,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ;AACd,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,IAAI;AAClE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAyD,EAAE,KAAK;AACtE,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,KAAK,EAAG,OAAM,QAAQ,MAAM,MAAM,KAAK;AAC1F,MAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAG,OAAM,OAAO,MAAM,KAAK,KAAK;AACtF,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA;AACA,QAAM,qBAAqB,WAAW,YAAY;AAClD,QAAM,2BAA2B,WAAW,kBAAkB;AAC9D,QAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,MAAM;AAClF,QAAM,sBACJ,6BAA6B,QAC5B,MAAM,mBAAmB,QAAQ,6BAA6B,MAAM;AACvE,SAAO,iBAAiB;AAC1B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,qBAAqB,eAAe,GAAG;AAC7C,MAAI,CAAC,mBAAmB,QAAQ;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,oBAAoB,IAAI,aAAa,IAAI,UAAU;AACzD,QAAM,iBAAiB,qBAAqB,kBAAkB,KAAK,EAAE,SAAS,kBAAkB,KAAK,IAAI;AAEzG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,gCAAgC,kBAAkB;AACpE,MAAI,CAAC,UAAU,QAAQ;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAAA,EACxC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,kBAAkB,4CAA4C,MAAM,KAAK;AAC/E,QAAM,WAAW,gBAAgB;AACjC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,gBAAgB;AACvC,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AAET,MAAI,uBAAuB;AAC3B,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,GAAG;AACvD,QAAI;AACF,YAAM,OAAO,QAAQ,aAAa;AAClC,6BAAuB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,6BAA6B,GAAG;AAAA,QAC9F;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,sBAAsB;AACxB,QAAI;AACF,YAAM,iCAAiC,IAAI,OAAO;AAAA,QAChD,WAAW,CAAC,QAAQ;AAAA,QACpB;AAAA,QACA,eAAe;AAAA,QACf,YAAY;AAAA,MACd,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,KAAK,mDAAmD;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,WAA0B;AAC9B,MAAI,SAAS,CAAC,gBAAgB;AAC5B,eAAW,0BAA0B;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI;AACF,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,QAAQ;AACV,eAAO,aAAa,KAAK,MAAM;AAAA,MACjC;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,wBAAwB,EAAE,IAAI,CAAC;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,0BAA0B,IAAI;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AAED,QAAM,mBAAmB,CAAC,EAAE,SAAS,GAAG,EAAE,UAAU,KAAsB,CAAC;AAC3E,QAAM,yBAAyB,CAAC,EAAE,gBAAgB,KAAsB,CAAC;AACzE,MAAI,eAAgB,wBAAuB,QAAQ,EAAE,eAAe,CAAC;AACrE,QAAM,YAAY,EAAE,UAAU,eAAe;AAE7C,QAAM,cAAc;AAAA,IAClB,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW;AAAA,IACX,MAAM;AAAA,MACJ,EAAE,KAAK,iBAAiB;AAAA,MACxB,EAAE,KAAK,uBAAuB;AAAA,IAChC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,GAAG,KAAK,gBAAgB,WAAkB,GAC3D,OAAO,CAAC,eAAoB,2BAA2B,YAAY,SAAS,CAAC;AAChF,QAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,IAChD,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW,EAAE,KAAK,KAAK;AAAA,IACvB,MAAM;AAAA,MACJ,EAAE,KAAK,iBAAiB;AAAA,MACxB,EAAE,KAAK,uBAAuB;AAAA,IAChC;AAAA,EACF,CAAQ,GAAG,OAAO,CAAC,eAAoB,2BAA2B,YAAY,SAAS,CAAC;AAExF,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,SAAS,YAAqB;AACvC,UAAM,MAAM,OAAO,MAAM,QAAQ;AACjC,QAAI,CAAC,mBAAmB,IAAI,GAAG,EAAG,oBAAmB,IAAI,KAAK,oBAAI,IAAI,CAAC;AACvE,uBAAmB,IAAI,GAAG,EAAG,IAAI,MAAM,GAAG;AAAA,EAC5C;AAEA,QAAM,aAAa,CAAC,OAAY,EAAE,WAAW,IAAI,MAAM,EAAE,iBAAiB,IAAI;AAE9E,QAAM,sBAAsB,oBAAI,IAAmB;AACnD,aAAW,KAAK,MAAM;AACpB,UAAM,MAAM,OAAO,EAAE,QAAQ;AAC7B,QAAI,CAAC,oBAAoB,IAAI,GAAG,EAAG,qBAAoB,IAAI,KAAK,CAAC,CAAC;AAClE,wBAAoB,IAAI,GAAG,EAAG,KAAK,CAAC;AAAA,EACtC;AAEA,QAAM,uBAAuB,oBAAI,IAAgC;AACjE,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,MAAM,2BAA2B,IAAI,UAAU,YAAY,IAAI;AAC9E,yBAAqB,IAAI,UAAU,MAAM;AAAA,EAC3C;AAEA,QAAM,QAAe,CAAC;AAEtB,QAAM,cAAc,oBAAI,IAAoB;AAC5C,YAAU,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,IAAI,GAAG,CAAC;AAEvD,aAAW,YAAY,WAAW;AAChC,UAAM,gBAAgB,oBAAoB,IAAI,QAAQ,KAAK,CAAC;AAC5D,QAAI,CAAC,cAAc,OAAQ;AAC3B,UAAM,iBAAiB,mBAAmB,IAAI,QAAQ,KAAK,oBAAI,IAAY;AAC3E,UAAM,QAAQ,oBAAI,IAAiB;AACnC,eAAW,KAAK,eAAe;AAC7B,YAAM,WAAW,MAAM,IAAI,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AAAE,cAAM,IAAI,EAAE,KAAK,CAAC;AAAG;AAAA,MAAS;AAC/C,YAAM,OAAO,WAAW,CAAC;AACzB,YAAM,OAAO,WAAW,QAAQ;AAChC,UAAI,OAAO,MAAM;AAAE,cAAM,IAAI,EAAE,KAAK,CAAC;AAAG;AAAA,MAAS;AACjD,UAAI,OAAO,KAAM;AACjB,YAAM,OAAQ,EAAE,qBAAqB,OAAQ,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AACnG,YAAM,OAAQ,SAAS,qBAAqB,OAAQ,SAAS,UAAU,QAAQ,IAAI,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACxH,UAAI,QAAQ,KAAM,OAAM,IAAI,EAAE,KAAK,CAAC;AAAA,IACtC;AAEA,UAAM,gBAAgB,qBAAqB,IAAI,QAAQ;AACvD,UAAM,UAAU,MAAM,KAAK,MAAM,OAAO,CAAC,EAAE,OAAO,CAAC,MAAY,EAAE,aAAa,SAAU,CAAC,eAAe,IAAI,EAAE,GAAG,CAAC;AAClH,YAAQ,KAAK,CAAC,GAAQ,OAAa,EAAE,YAAY,YAAY,MAAM,EAAE,YAAY,YAAY,EAAG;AAEhG,eAAW,KAAK,SAAS;AACvB,YAAM,cAAc,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,SAAS,KAAK,IAAI;AAChG,YAAM,qBAAqB,YAAY,SAAS,IAAI,cAAc;AAClE,YAAM,sBAAsB,MAAM,QAAQ,EAAE,YAAY,SAAS,IAC7D,EAAE,WAAW,UACV,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,qBAAqB,oBAAoB,SAAS,IACpD,sBACC,qBAAqB,CAAC,kBAAkB,IAAI,CAAC;AAClD,UAAI,kBAAkB,CAAC,mBAAmB,SAAS,cAAc,EAAG;AACpE,YAAM,YAAY,oBAAoB,EAAE,YAAY,KAAK;AACzD,YAAM,WAAW,OAAO,EAAE,GAAG,EAAE,YAAY;AAC3C,YAAM,gBAAgB;AAAA,QACpB,KAAK,EAAE;AAAA,QACP,MAAM,EAAE;AAAA,QACR,OAAO,EAAE,YAAY,SAAS,EAAE;AAAA,QAChC,aAAa,EAAE,YAAY,eAAe;AAAA,QAC1C,OAAO,QAAQ,EAAE,YAAY,KAAK;AAAA,QAClC,UAAU,MAAM;AACd,cAAI,EAAE,SAAS,WAAY,QAAO;AAClC,gBAAM,oBAAoB,4BAA4B,EAAE,YAAY,OAAO;AAC3E,iBAAO,kBAAkB,SAAS,oBAAoB;AAAA,QACxD,GAAG;AAAA,QACH,aAAa,MAAM;AACjB,cAAI,EAAE,SAAS,WAAY,QAAO;AAClC,gBAAM,eAAe,OAAO,EAAE,YAAY,iBAAiB,WAAW,EAAE,WAAW,eAAe;AAClG,cAAI,aAAc,QAAO,qBAAqB,YAAY;AAC1D,iBAAO,OAAO,EAAE,YAAY,eAAe,WAAW,EAAE,WAAW,aAAa;AAAA,QAClF,GAAG;AAAA,QACH,YAAY,QAAQ,EAAE,YAAY,UAAU;AAAA,QAC5C,cAAc,EAAE,YAAY,iBAAiB,SAAY,QAAQ,EAAE,WAAW,YAAY,IAAI;AAAA,QAC9F,aAAa,EAAE,YAAY,gBAAgB,SAAY,QAAQ,EAAE,WAAW,WAAW,IAAI;AAAA,QAC3F,QAAQ,OAAO,EAAE,YAAY,WAAW,WACpC,EAAE,WAAW,SACZ,EAAE,SAAS,cAAc,gBAAgB;AAAA,QAC9C,OAAO,OAAO,EAAE,YAAY,UAAU,WAAW,EAAE,WAAW,QAAQ;AAAA,QACtE,cAAc,OAAO,EAAE,YAAY,iBAAiB,WAAW,EAAE,WAAW,eAAe;AAAA,QAC3F,wBAAwB,EAAE,YAAY,2BAA2B,SAC7D,QAAQ,EAAE,WAAW,sBAAsB,IAC3C;AAAA,QACJ,UAAU,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,WAAW;AAAA,QAC/E,YAAY,MAAM,QAAQ,EAAE,YAAY,UAAU,IAAI,EAAE,WAAW,aAAa;AAAA,QAChF,cAAc,EAAE,YAAY,iBAAiB,SAAY,EAAE,WAAW,eAAe;AAAA;AAAA,QAErF,qBAAqB,OAAO,EAAE,YAAY,wBAAwB,WAAW,EAAE,WAAW,sBAAsB;AAAA,QAChH,kBAAkB,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,EAAE,WAAW,mBAAmB;AAAA,QAClG;AAAA,QACA,UAAU,sBAAsB,mBAAmB,CAAC;AAAA,QACpD,WAAW,mBAAmB,SAAS,IAAI,qBAAqB;AAAA,QAChE,OAAO;AAAA,MACT;AACA,YAAM,UAAU,uBAAuB,GAAG,eAAe,YAAY,IAAI,QAAQ,KAAK,OAAO,gBAAgB;AAC7G,YAAM,YAAY,EAAE,GAAG,eAAe,SAAS,QAAQ;AACvD,YAAM,WAAY,MAAgB,KAAK,CAAC,UAAU,MAAM,IAAI,YAAY,MAAM,QAAQ;AACtF,UAAI,CAAC,UAAU;AACb,cAAM,KAAK,SAAS;AACpB;AAAA,MACF;AACA,YAAM,gBAAgB,SAAS;AAC/B,YAAM,qBAAqB,UAAU;AACrC,YAAM,SACJ,mBAAmB,OAAO,cAAc,QACvC,mBAAmB,SAAS,cAAc,QAAQ,mBAAmB,UAAU,cAAc,WAC7F,mBAAmB,SAAS,cAAc,QAAQ,mBAAmB,YAAY,cAAc,WAAW,mBAAmB,cAAc,cAAc;AAC5J,UAAI,QAAQ;AACV,cAAM,QAAQ,MAAM,UAAU,CAAC,UAAU,MAAM,IAAI,YAAY,MAAM,QAAQ;AAC7E,YAAI,SAAS,EAAG,OAAM,KAAK,IAAI;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,IAAI,CAAC,SAAc;AACzC,UAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAC7B,WAAO;AAAA,EACT,CAAC;AACD,YAAU,KAAK,CAAC,GAAQ,OAAa,EAAE,YAAY,MAAM,EAAE,YAAY,EAAG;AAE1E,QAAM,oBAAgE,CAAC;AACvE,QAAM,iBAAuE,CAAC;AAC9E,aAAW,YAAY,WAAW;AAChC,UAAM,MAAM,gBAAgB,IAAI,QAAQ,KAAK,EAAE,WAAW,CAAC,GAAG,yBAAyB,KAAK;AAC5F,sBAAkB,QAAQ,IAAI,IAAI;AAClC,mBAAe,QAAQ,IAAI,EAAE,yBAAyB,IAAI,wBAAwB;AAAA,EACpF;AAEA,QAAM,eAAe,EAAE,OAAO,WAAW,mBAAmB,eAAe;AAE3E,MAAI,SAAS,YAAY,CAAC,gBAAgB;AACxC,UAAM,OAAO,2BAA2B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI;AACF,YAAM,MAAM,IAAI,UAAU,cAAc;AAAA,QACtC,KAAK;AAAA,QACL;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,KAAK,+BAA+B,EAAE,IAAI,CAAC;AAAA,IACpD;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,YAAY;AACvC;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,QAAQ,OAAO;AAErB,MAAI,CAAC,yBAAyB,MAAM,QAAQ,GAAG;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,kDAAkD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,eAAe,MAAM,YAAY;AACvC,QAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,EAAE,WAAW,GAAG;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,wDAAwD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9G;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,+BAA+B,EAAE,MAAM,WAAW,SAAS,IAAI,CAAC;AACpF,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AAET,QAAM,QAAa,2BAA2B,MAAM,UAAU,MAAM,KAAK,KAAK;AAC9E,MAAI,MAAM,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AAEhD,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,MAAM,IAAI,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,GAAG;AAAA,IACzD,WAAW,MAAM,WAAW;AAAA,IAC5B,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,CAAC,IAAK,OAAM,GAAG,OAAO,gBAAgB,EAAE,GAAG,OAAO,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC7E,MAAI,OAAO,MAAM;AACjB,QAAM,QAAS,MAAc,cAAc,CAAC;AAC5C,QAAM,MAA2B,EAAE,GAAG,MAAM;AAC5C,MAAI,IAAI,SAAS,QAAQ,OAAO,IAAI,KAAK,EAAE,KAAK,MAAM,GAAI,KAAI,QAAQ,MAAM;AAC5E,MAAI,IAAI,iBAAiB,OAAW,KAAI,eAAe;AACvD,MAAI,IAAI,gBAAgB,OAAW,KAAI,cAAc;AACrD,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,IAAI;AACtF,QAAI,eAAe;AACnB,QAAI,yBAAyB,IAAI,2BAA2B;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,YAAY;AAC7B,QAAI,aAAa;AACjB,QAAI,MAAM,QAAQ,IAAI,OAAO,EAAG,QAAO,IAAI;AAAA,EAC7C;AACA,MAAI,MAAM,SAAS,gBAAgB,IAAI,UAAU,QAAQ,OAAO,IAAI,MAAM,EAAE,KAAK,MAAM,KAAK;AAC1F,QAAI,SAAS;AAAA,EACf;AAEA,MAAI,IAAI,iBAAiB,UAAa,IAAI,iBAAiB,MAAM;AAC/D,UAAM,kBAAkB,MAAM;AAAA,MAC5B,IAAI;AAAA,MAAc,MAAM;AAAA,MAAM;AAAA,MAAK;AAAA,MACnC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AACA,QAAI,iBAAiB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtE;AACA,QAAI,eAAe,4BAA4B,IAAI,cAAc,MAAM,IAAI;AAAA,EAC7E;AACA,MAAI,aAAa;AACjB,MAAI,WAAW,MAAM,YAAY;AACjC,MAAI,YAAY,IAAI,aAAa,QAAS,IAAI,aAAa,oBAAI,KAAK,IAAK;AACzE,MAAI,YAAY,oBAAI,KAAK;AACzB,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAC5B,QAAM,2BAA2B,OAAO;AAAA,IACtC,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW,CAAC,MAAM,QAAQ;AAAA,EAC5B,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,IAAI,IAAI,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,MAAM,YAAY,IAAI,YAAY,UAAU,IAAI,SAAS,EAAE,CAAC;AAC/I;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,EAAE,UAAU,IAAI,IAAI,QAAQ,CAAC;AACnC,MAAI,CAAC,YAAY,CAAC,IAAK,QAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,+BAA+B,EAAE,MAAM,WAAW,SAAS,IAAI,CAAC;AACpF,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AACT,QAAM,QAAa,2BAA2B,UAAU,KAAK,KAAK;AAClE,MAAI,MAAM,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AAChD,MAAI,YAAwB;AAC5B,MAAI,CAAC,KAAK;AACR,gBAAY,8BAA8B,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACtE;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,WAAW,MAAM,UAAU,KAAK;AAAA,IACpC,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,KAAK,MAAM,WAAW,MAAM,GAAG,QAAQ,IAAI,GAAG;AAAA,IAC1D,WAAW;AAAA,IACX,iBAAiB,EAAE,UAAU,IAAI;AAAA,EACnC,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,CAAC,KAAK;AACR,UAAM,gCAAgC,IAAI,WAAW,KAAK;AAAA,EAC5D,OAAO;AACL,6BAAyB,GAAG;AAAA,EAC9B;AACA,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAC5B,QAAM,2BAA2B,OAAO;AAAA,IACtC,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW,CAAC,QAAQ;AAAA,EACtB,CAAC;AAID,QAAM,UAAU,MAAM,gCAAgC,IAAI;AAAA,IACxD;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,CAAC;AAChD;AAEA,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EAC9D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AACzD,CAAC,EACA;AAAA,EACC,CAAC,UAAU;AACT,QAAI,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO;AACrG,QAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,EAAG,QAAO;AACvE,WAAO,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,KAAK,EAAE,SAAS;AAAA,EAChF;AAAA,EACA,EAAE,SAAS,sDAAsD;AACnE;AAEF,MAAM,+BAA+B,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;AAErE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,MAAM,4BAA4B,EAAE,SAAS;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,EAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAChF,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EACJ,OAAO;AAAA,IACN,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,MAAM,iCAAiC,EAAE,SAAS;AAC9D,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,2BAA2B;AAAA,EAC1C,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,4BAA4B,CAAC,EAAE,SAAS;AAAA,EACxF,gBAAgB,EACb;AAAA,IACC,EAAE,OAAO;AAAA,IACT,EAAE,OAAO;AAAA,MACP,yBAAyB,EAAE,QAAQ,EAAE,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,IACxC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,UAAU,EAAE,OAAO;AAAA,EACnB,KAAK,EAAE,OAAO;AAChB,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AACA,MAAM,yBAAyB,CAAC,KAAU,KAA0B,gBAAwB;AAC1F,QAAM,mBAAmB,IAAI,gBAAgB,QAAQ,IAAI;AACzD,QAAM,oBAAoB,IAAI,iBAAiB,QAAQ,IAAI;AAC3D,QAAM,kBAAkB,IAAI,aAAa,IAAI;AAC7C,QAAM,aAAa,MAAM;AACvB,YAAQ,IAAI,MAAM;AAAA,MAChB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,GAAG;AACH,QAAM,eAAe,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,IAAI;AAC5E,QAAM,kBAAkB,OAAO,IAAI,iBAAiB,YAAY,IAAI,aAAa,KAAK,EAAE,SAAS,IAAI;AACrG,QAAM,OAAQ,mBAAmB,KAAO,oBAAoB,IAAM,kBAAkB,IAAK,YAAY,eAAe;AACpH,QAAM,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAClE,SAAO,EAAE,MAAM,SAAS,YAAY;AACtC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomEntity, CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'\nimport { upsertCustomFieldDefSchema, fieldsetCodeRegex } from '@open-mercato/core/modules/entities/data/validators'\nimport {\n  createDefinitionsCacheKey,\n  createDefinitionsCacheTags,\n  invalidateDefinitionsCache,\n  ENTITY_DEFINITIONS_CACHE_TTL_MS,\n} from './definitions.cache'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { filterSelectableSystemEntityIds, isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/system-entities'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { loadEntityFieldsetConfigs, CustomFieldsetDefinition } from '../lib/fieldsets'\nimport { installCustomEntitiesFromModules } from '../lib/install-from-ce'\nimport { normalizeCustomFieldOptions } from '@open-mercato/shared/modules/entities/options'\nimport { CURRENCY_OPTIONS_URL } from '@open-mercato/shared/modules/entities/kinds'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  beginEntitiesMutationGuard,\n  FIELD_DEFINITION_RESOURCE_KIND,\n} from './definitions.mutation-guard'\nimport {\n  createExactDefinitionWhere,\n  createScopedDefinitionTombstone,\n  createVisibleDefinitionWhere,\n  markDefinitionTombstoned,\n  resolveDefinitionScopeFromOrganizationScope,\n  resolveDefinitionMutationScope,\n  selectVisibleDefinitionWinner,\n} from '../lib/definition-scope'\nimport { resolveEntityDefinitionsVersion } from '../lib/definitions-version'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('entities').child({ component: 'definitions' })\n\n/**\n * Validate defaultValue against the field kind. Returns an error message string\n * if invalid, or null if valid. For dictionary and currency kinds, queries the\n * database to verify the token exists.\n */\nasync function validateDefaultValueByKind(\n  value: unknown,\n  kind: string,\n  cfg: Record<string, unknown>,\n  em: EntityManager,\n  tenantContext: { tenantId: string | null; organizationId: string | null },\n): Promise<string | null> {\n  switch (kind) {\n    case 'boolean':\n      if (typeof value !== 'boolean') return 'defaultValue for boolean fields must be true or false'\n      return null\n    case 'integer':\n      if (typeof value !== 'number' || !Number.isInteger(value))\n        return 'defaultValue for integer fields must be a whole number'\n      return null\n    case 'float':\n      if (typeof value !== 'number' || !isFinite(value))\n        return 'defaultValue for float fields must be a finite number'\n      return null\n    case 'text':\n    case 'multiline':\n    case 'date':\n    case 'datetime':\n      if (typeof value !== 'string')\n        return `defaultValue for ${kind} fields must be a string`\n      return null\n    case 'dictionary': {\n      if (typeof value !== 'string')\n        return 'defaultValue for dictionary fields must be a string'\n      const dictionaryId = typeof cfg.dictionaryId === 'string' ? cfg.dictionaryId.trim() : ''\n      if (dictionaryId) {\n        try {\n          const { DictionaryEntry } = await import('@open-mercato/core/modules/dictionaries/data/entities')\n          const entry = await em.findOne(DictionaryEntry, {\n            dictionary: dictionaryId,\n            value: value,\n            ...(tenantContext.organizationId ? { organizationId: tenantContext.organizationId } : {}),\n            ...(tenantContext.tenantId ? { tenantId: tenantContext.tenantId } : {}),\n          })\n          if (!entry) return `defaultValue \"${value}\" does not match any entry in the configured dictionary`\n        } catch (err) {\n          // If the dictionaries module is not available, skip entry validation\n          logger.debug('Dictionary validation skipped \u2014 module not available', { err })\n        }\n      }\n      return null\n    }\n    case 'currency': {\n      if (typeof value !== 'string')\n        return 'defaultValue for currency fields must be a string'\n      try {\n        const { Currency } = await import('@open-mercato/core/modules/currencies/data/entities')\n        const where: Record<string, string> = { code: value as string }\n        if (tenantContext.tenantId) where.tenantId = tenantContext.tenantId\n        if (tenantContext.organizationId) where.organizationId = tenantContext.organizationId\n        const currency = await em.findOne(Currency, where)\n        if (!currency) return `defaultValue \"${value}\" does not match any available currency`\n      } catch (err) {\n        // If the currencies module is not available, skip currency validation\n        logger.debug('Currency validation skipped \u2014 module not available', { err })\n      }\n      return null\n    }\n    case 'select': {\n      if (typeof value !== 'string' && typeof value !== 'number')\n        return 'defaultValue for select fields must be a string or number'\n      const options = normalizeCustomFieldOptions(\n        Array.isArray(cfg.options) ? cfg.options : [],\n      )\n      if (options.length > 0) {\n        const match = options.some(\n          (o) => o.value === value || String(o.value) === String(value),\n        )\n        if (!match) return 'defaultValue does not match any of the configured options'\n      }\n      return null\n    }\n    case 'relation':\n    case 'attachment':\n      return `defaultValue is not supported for ${kind} fields`\n    default:\n      return null\n  }\n}\n\n/**\n * Normalize defaultValue to the canonical storage shape for the given kind.\n */\nfunction normalizeDefaultValueByKind(value: unknown, kind: string): unknown {\n  switch (kind) {\n    case 'boolean':\n      return value === true\n    case 'integer':\n      return Math.round(Number(value))\n    case 'float':\n      return Number(value)\n    default:\n      return value\n  }\n}\n\nexport const metadata = {\n  // Reading definitions is needed by record forms; keep it auth-protected but accessible to all authenticated users\n  GET: { requireAuth: true },\n  // Mutations remain admin-only\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nfunction parseEntityIds(url: URL): string[] {\n  const direct = url.searchParams.getAll('entityId').filter((id) => typeof id === 'string' && id.trim().length > 0)\n  const combined = url.searchParams.get('entityIds')\n  if (combined) {\n    combined\n      .split(',')\n      .map((id) => id.trim())\n      .filter((id) => id.length > 0)\n      .forEach((id) => direct.push(id))\n  }\n  const unique: string[] = []\n  const seen = new Set<string>()\n  for (const id of direct) {\n    if (seen.has(id)) continue\n    seen.add(id)\n    unique.push(id)\n  }\n  return unique\n}\n\nasync function resolveEntityDefaultEditor(em: any, entityId: string, tenantId: string | null | undefined): Promise<string | undefined> {\n  try {\n    const ent = await em.findOne(CustomEntity, {\n      entityId,\n      $and: [\n        { $or: [ { tenantId: tenantId ?? undefined as any }, { tenantId: null } ] },\n      ],\n    } as any)\n    if (ent && typeof (ent as any).defaultEditor === 'string') return (ent as any).defaultEditor\n  } catch {}\n  return undefined\n}\n\nfunction normalizeFieldGroup(raw: unknown): { code: string; title?: string; hint?: string } | undefined {\n  if (!raw) return undefined\n  if (typeof raw === 'string') {\n    const code = raw.trim()\n    return code ? { code } : undefined\n  }\n  if (typeof raw !== 'object') return undefined\n  const entry = raw as Record<string, unknown>\n  const code = typeof entry.code === 'string' ? entry.code.trim() : ''\n  if (!code) return undefined\n  const group: { code: string; title?: string; hint?: string } = { code }\n  if (typeof entry.title === 'string' && entry.title.trim()) group.title = entry.title.trim()\n  if (typeof entry.hint === 'string' && entry.hint.trim()) group.hint = entry.hint.trim()\n  return group\n}\n\nfunction definitionMatchesReadScope(\n  definition: { tenantId?: string | null; organizationId?: string | null },\n  scope: { tenantId: string | null; organizationId: string | null },\n) {\n  const definitionTenantId = definition.tenantId ?? null\n  const definitionOrganizationId = definition.organizationId ?? null\n  const tenantMatches = definitionTenantId === null || definitionTenantId === scope.tenantId\n  const organizationMatches =\n    definitionOrganizationId === null ||\n    (scope.organizationId !== null && definitionOrganizationId === scope.organizationId)\n  return tenantMatches && organizationMatches\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const requestedEntityIds = parseEntityIds(url)\n  if (!requestedEntityIds.length) {\n    return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n  }\n  const requestedFieldset = url.searchParams.get('fieldset')\n  const fieldsetFilter = requestedFieldset && requestedFieldset.trim().length ? requestedFieldset.trim() : null\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const entityIds = filterSelectableSystemEntityIds(requestedEntityIds)\n  if (!entityIds.length) {\n    return NextResponse.json({ items: [] })\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const definitionScope = resolveDefinitionScopeFromOrganizationScope(auth, scope)\n  const tenantId = definitionScope.tenantId\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = definitionScope.organizationId\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n\n  let canManageDefinitions = false\n  if (typeof auth.sub === 'string' && auth.sub.length > 0) {\n    try {\n      const rbac = resolve('rbacService') as RbacService\n      canManageDefinitions = await rbac.userHasAllFeatures(auth.sub, ['entities.definitions.manage'], {\n        tenantId,\n        organizationId,\n      })\n    } catch {\n      // RBAC service unavailable \u2014 fall back to read-only (no definition sync)\n    }\n  }\n\n  if (canManageDefinitions) {\n    try {\n      await installCustomEntitiesFromModules(em, cache, {\n        tenantIds: [tenantId],\n        entityIds,\n        includeGlobal: true,\n        createOnly: true,\n      })\n    } catch (err) {\n      logger.warn('Failed to synchronize module-backed definitions', {\n        tenantId,\n        entityIds,\n        err,\n      })\n    }\n  }\n\n  let cacheKey: string | null = null\n  if (cache && !fieldsetFilter) {\n    cacheKey = createDefinitionsCacheKey({\n      tenantId,\n      organizationId,\n      entityIds,\n    })\n    try {\n      const cached = await cache.get(cacheKey)\n      if (cached) {\n        return NextResponse.json(cached)\n      }\n    } catch (err) {\n      logger.warn('Failed to read cache', { err })\n    }\n  }\n\n  const fieldsetConfigs = await loadEntityFieldsetConfigs(em, {\n    entityIds,\n    tenantId,\n    organizationId,\n    mode: 'public',\n  })\n\n  const tenantCandidates = [{ tenantId }, { tenantId: null as string | null }]\n  const organizationCandidates = [{ organizationId: null as string | null }]\n  if (organizationId) organizationCandidates.unshift({ organizationId })\n  const readScope = { tenantId, organizationId }\n\n  const whereActive = {\n    entityId: { $in: entityIds as any },\n    deletedAt: null,\n    $and: [\n      { $or: tenantCandidates },\n      { $or: organizationCandidates },\n    ],\n  } as any\n  const defs = (await em.find(CustomFieldDef, whereActive as any))\n    .filter((definition: any) => definitionMatchesReadScope(definition, readScope))\n  const tombstones = (await em.find(CustomFieldDef, {\n    entityId: { $in: entityIds as any },\n    deletedAt: { $ne: null } as any,\n    $and: [\n      { $or: tenantCandidates },\n      { $or: organizationCandidates },\n    ],\n  } as any)).filter((definition: any) => definitionMatchesReadScope(definition, readScope))\n\n  const tombstonedByEntity = new Map<string, Set<string>>()\n  for (const entry of tombstones as any[]) {\n    const eid = String(entry.entityId)\n    if (!tombstonedByEntity.has(eid)) tombstonedByEntity.set(eid, new Set())\n    tombstonedByEntity.get(eid)!.add(entry.key)\n  }\n\n  const scopeScore = (x: any) => (x.tenantId ? 2 : 0) + (x.organizationId ? 1 : 0)\n\n  const definitionsByEntity = new Map<string, any[]>()\n  for (const d of defs) {\n    const eid = String(d.entityId)\n    if (!definitionsByEntity.has(eid)) definitionsByEntity.set(eid, [])\n    definitionsByEntity.get(eid)!.push(d)\n  }\n\n  const entityDefaultEditors = new Map<string, string | undefined>()\n  for (const entityId of entityIds) {\n    const editor = await resolveEntityDefaultEditor(em, entityId, tenantId ?? null)\n    entityDefaultEditors.set(entityId, editor)\n  }\n\n  const items: any[] = []\n\n  const entityOrder = new Map<string, number>()\n  entityIds.forEach((id, idx) => entityOrder.set(id, idx))\n\n  for (const entityId of entityIds) {\n    const defsForEntity = definitionsByEntity.get(entityId) ?? []\n    if (!defsForEntity.length) continue\n    const tombstonedKeys = tombstonedByEntity.get(entityId) ?? new Set<string>()\n    const byKey = new Map<string, any>()\n    for (const d of defsForEntity) {\n      const existing = byKey.get(d.key)\n      if (!existing) { byKey.set(d.key, d); continue }\n      const sNew = scopeScore(d)\n      const sOld = scopeScore(existing)\n      if (sNew > sOld) { byKey.set(d.key, d); continue }\n      if (sNew < sOld) continue\n      const tNew = (d.updatedAt instanceof Date) ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const tOld = (existing.updatedAt instanceof Date) ? existing.updatedAt.getTime() : new Date(existing.updatedAt).getTime()\n      if (tNew >= tOld) byKey.set(d.key, d)\n    }\n\n    const defaultEditor = entityDefaultEditors.get(entityId)\n    const winning = Array.from(byKey.values()).filter((d: any) => (d.isActive !== false) && !tombstonedKeys.has(d.key))\n    winning.sort((a: any, b: any) => ((a.configJson?.priority ?? 0) - (b.configJson?.priority ?? 0)))\n\n    for (const d of winning) {\n      const rawFieldset = typeof d.configJson?.fieldset === 'string' ? d.configJson.fieldset.trim() : ''\n      const normalizedFieldset = rawFieldset.length > 0 ? rawFieldset : undefined\n      const normalizedFieldsets = Array.isArray(d.configJson?.fieldsets)\n        ? d.configJson.fieldsets\n            .filter((entry: unknown): entry is string => typeof entry === 'string')\n            .map((entry: string) => entry.trim())\n            .filter((entry: string) => entry.length > 0)\n        : []\n      const effectiveFieldsets = normalizedFieldsets.length > 0\n        ? normalizedFieldsets\n        : (normalizedFieldset ? [normalizedFieldset] : [])\n      if (fieldsetFilter && !effectiveFieldsets.includes(fieldsetFilter)) continue\n      const groupInfo = normalizeFieldGroup(d.configJson?.group)\n      const keyLower = String(d.key).toLowerCase()\n      const candidateBase = {\n        key: d.key,\n        kind: d.kind,\n        label: d.configJson?.label || d.key,\n        description: d.configJson?.description || undefined,\n        multi: Boolean(d.configJson?.multi),\n        options: (() => {\n          if (d.kind === 'currency') return undefined\n          const normalizedOptions = normalizeCustomFieldOptions(d.configJson?.options)\n          return normalizedOptions.length ? normalizedOptions : undefined\n        })(),\n        optionsUrl: (() => {\n          if (d.kind === 'currency') return CURRENCY_OPTIONS_URL\n          const dictionaryId = typeof d.configJson?.dictionaryId === 'string' ? d.configJson.dictionaryId : undefined\n          if (dictionaryId) return `/api/dictionaries/${dictionaryId}/entries`\n          return typeof d.configJson?.optionsUrl === 'string' ? d.configJson.optionsUrl : undefined\n        })(),\n        filterable: Boolean(d.configJson?.filterable),\n        formEditable: d.configJson?.formEditable !== undefined ? Boolean(d.configJson.formEditable) : true,\n        listVisible: d.configJson?.listVisible !== undefined ? Boolean(d.configJson.listVisible) : true,\n        editor: typeof d.configJson?.editor === 'string'\n          ? d.configJson.editor\n          : (d.kind === 'multiline' ? defaultEditor : undefined),\n        input: typeof d.configJson?.input === 'string' ? d.configJson.input : undefined,\n        dictionaryId: typeof d.configJson?.dictionaryId === 'string' ? d.configJson.dictionaryId : undefined,\n        dictionaryInlineCreate: d.configJson?.dictionaryInlineCreate !== undefined\n          ? Boolean(d.configJson.dictionaryInlineCreate)\n          : undefined,\n        priority: typeof d.configJson?.priority === 'number' ? d.configJson.priority : 0,\n        validation: Array.isArray(d.configJson?.validation) ? d.configJson.validation : undefined,\n        defaultValue: d.configJson?.defaultValue !== undefined ? d.configJson.defaultValue : undefined,\n        // attachments config passthrough\n        maxAttachmentSizeMb: typeof d.configJson?.maxAttachmentSizeMb === 'number' ? d.configJson.maxAttachmentSizeMb : undefined,\n        acceptExtensions: Array.isArray(d.configJson?.acceptExtensions) ? d.configJson.acceptExtensions : undefined,\n        // phone config passthrough\n        defaultCountryIso2: typeof d.configJson?.defaultCountryIso2 === 'string' ? d.configJson.defaultCountryIso2 : undefined,\n        entityId,\n        fieldset: normalizedFieldset ?? effectiveFieldsets[0],\n        fieldsets: effectiveFieldsets.length > 0 ? effectiveFieldsets : undefined,\n        group: groupInfo,\n      } as any\n      const metrics = computeDefinitionScore(d, candidateBase, entityOrder.get(entityId) ?? Number.MAX_SAFE_INTEGER)\n      const candidate = { ...candidateBase, __score: metrics }\n      const existing = (items as any[]).find((entry) => entry.key.toLowerCase() === keyLower)\n      if (!existing) {\n        items.push(candidate)\n        continue\n      }\n      const existingScore = existing.__score as { base: number; penalty: number; entityIndex: number }\n      const candidateScoreInfo = candidate.__score as { base: number; penalty: number; entityIndex: number }\n      const better =\n        candidateScoreInfo.base > existingScore.base ||\n        (candidateScoreInfo.base === existingScore.base && candidateScoreInfo.penalty < existingScore.penalty) ||\n        (candidateScoreInfo.base === existingScore.base && candidateScoreInfo.penalty === existingScore.penalty && candidateScoreInfo.entityIndex < existingScore.entityIndex)\n      if (better) {\n        const index = items.findIndex((entry) => entry.key.toLowerCase() === keyLower)\n        if (index >= 0) items[index] = candidate\n      }\n    }\n  }\n\n  const sanitized = items.map((item: any) => {\n    const { __score, ...rest } = item\n    return rest\n  })\n  sanitized.sort((a: any, b: any) => ((a.priority ?? 0) - (b.priority ?? 0)))\n\n  const fieldsetsByEntity: Record<string, CustomFieldsetDefinition[]> = {}\n  const entitySettings: Record<string, { singleFieldsetPerRecord: boolean }> = {}\n  for (const entityId of entityIds) {\n    const cfg = fieldsetConfigs.get(entityId) ?? { fieldsets: [], singleFieldsetPerRecord: true }\n    fieldsetsByEntity[entityId] = cfg.fieldsets\n    entitySettings[entityId] = { singleFieldsetPerRecord: cfg.singleFieldsetPerRecord }\n  }\n\n  const responseBody = { items: sanitized, fieldsetsByEntity, entitySettings }\n\n  if (cache && cacheKey && !fieldsetFilter) {\n    const tags = createDefinitionsCacheTags({\n      tenantId,\n      organizationId,\n      entityIds,\n    })\n    try {\n      await cache.set(cacheKey, responseBody, {\n        ttl: ENTITY_DEFINITIONS_CACHE_TTL_MS,\n        tags,\n      })\n    } catch (err) {\n      logger.warn('Failed to store cache entry', { err })\n    }\n  }\n\n  return NextResponse.json(responseBody)\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = upsertCustomFieldDefSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const input = parsed.data\n\n  if (!isSystemEntitySelectable(input.entityId)) {\n    return NextResponse.json({ error: 'Custom fields are not supported for this entity' }, { status: 400 })\n  }\n\n  if (input.kind === 'dictionary') {\n    const dictionaryId = input.configJson?.dictionaryId\n    if (typeof dictionaryId !== 'string' || dictionaryId.trim().length === 0) {\n      return NextResponse.json({ error: 'dictionaryId is required for dictionary custom fields' }, { status: 400 })\n    }\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n\n  const where: any = createExactDefinitionWhere(input.entityId, input.key, scope)\n  let def = await em.findOne(CustomFieldDef, where)\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: FIELD_DEFINITION_RESOURCE_KIND,\n    resourceId: def ? def.id : `${input.entityId}:${input.key}`,\n    operation: def ? 'update' : 'create',\n    mutationPayload: input as unknown as Record<string, unknown>,\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  if (!def) def = em.create(CustomFieldDef, { ...where, createdAt: new Date() })\n  def.kind = input.kind\n  const inCfg = (input as any).configJson ?? {}\n  const cfg: Record<string, any> = { ...inCfg }\n  if (cfg.label == null || String(cfg.label).trim() === '') cfg.label = input.key\n  if (cfg.formEditable === undefined) cfg.formEditable = true\n  if (cfg.listVisible === undefined) cfg.listVisible = true\n  if (input.kind === 'dictionary') {\n    const dictionaryId = typeof cfg.dictionaryId === 'string' ? cfg.dictionaryId.trim() : ''\n    cfg.dictionaryId = dictionaryId\n    cfg.dictionaryInlineCreate = cfg.dictionaryInlineCreate !== false\n  }\n  if (input.kind === 'currency') {\n    cfg.optionsUrl = CURRENCY_OPTIONS_URL\n    if (Array.isArray(cfg.options)) delete cfg.options\n  }\n  if (input.kind === 'multiline' && (cfg.editor == null || String(cfg.editor).trim() === '')) {\n    cfg.editor = 'markdown'\n  }\n  // Validate and normalize defaultValue by kind before persisting\n  if (cfg.defaultValue !== undefined && cfg.defaultValue !== null) {\n    const validationError = await validateDefaultValueByKind(\n      cfg.defaultValue, input.kind, cfg, em,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n    if (validationError) {\n      return NextResponse.json({ error: validationError }, { status: 400 })\n    }\n    cfg.defaultValue = normalizeDefaultValueByKind(cfg.defaultValue, input.kind)\n  }\n  def.configJson = cfg\n  def.isActive = input.isActive ?? true\n  def.deletedAt = def.isActive === false ? (def.deletedAt ?? new Date()) : null\n  def.updatedAt = new Date()\n  em.persist(def)\n  await em.flush()\n  await guard.runAfterSuccess()\n  await invalidateDefinitionsCache(cache, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    entityIds: [input.entityId],\n  })\n  // Changing field definitions may impact forms but not sidebar items; no nav cache touch\n  return NextResponse.json({ ok: true, item: { id: def.id, key: def.key, kind: def.kind, configJson: def.configJson, isActive: def.isActive } })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const { entityId, key } = body || {}\n  if (!entityId || !key) return NextResponse.json({ error: 'entityId and key are required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const scope = await resolveDefinitionMutationScope({ auth, container, request: req })\n  const { resolve } = container\n  const em = resolve('em') as any\n  let cache: CacheStrategy | undefined\n  try {\n    cache = resolve('cache') as CacheStrategy\n  } catch {}\n  const where: any = createExactDefinitionWhere(entityId, key, scope)\n  let def = await em.findOne(CustomFieldDef, where)\n  let inherited: any | null = null\n  if (!def) {\n    inherited = selectVisibleDefinitionWinner(await em.find(CustomFieldDef, createVisibleDefinitionWhere(\n      entityId,\n      key,\n      scope,\n      { deletedAt: null, isActive: true },\n    )))\n    if (!inherited) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: FIELD_DEFINITION_RESOURCE_KIND,\n    resourceId: def?.id ?? inherited?.id ?? `${entityId}:${key}`,\n    operation: 'delete',\n    mutationPayload: { entityId, key },\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  if (!def) {\n    def = createScopedDefinitionTombstone(em, inherited, scope)\n  } else {\n    markDefinitionTombstoned(def)\n  }\n  em.persist(def)\n  await em.flush()\n  await guard.runAfterSuccess()\n  await invalidateDefinitionsCache(cache, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    entityIds: [entityId],\n  })\n  // Changing field definitions may impact forms but not sidebar items; no nav cache touch\n  // Return the post-delete aggregate version so the edit form keeps its optimistic-lock\n  // token in sync after removing a field out-of-band (issue #3152).\n  const version = await resolveEntityDefinitionsVersion(em, {\n    entityId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  return NextResponse.json({ ok: true, version })\n}\n\nconst definitionsQuerySchema = z\n  .object({\n    entityId: z.union([z.string(), z.array(z.string())]).optional(),\n    entityIds: z.string().optional(),\n    fieldset: z.string().regex(fieldsetCodeRegex).optional(),\n  })\n  .refine(\n    (value) => {\n      if (value.entityId && typeof value.entityId === 'string' && value.entityId.trim().length > 0) return true\n      if (Array.isArray(value.entityId) && value.entityId.length > 0) return true\n      return typeof value.entityIds === 'string' && value.entityIds.trim().length > 0\n    },\n    { message: 'Provide at least one entityId or an entityIds list.' }\n  )\n\nconst customFieldOptionValueSchema = z.union([z.string(), z.number()])\n\nconst customFieldDefinitionSchema = z.object({\n  key: z.string(),\n  kind: z.string(),\n  label: z.string(),\n  description: z.string().optional(),\n  multi: z.boolean().optional(),\n  options: z.array(customFieldOptionValueSchema).optional(),\n  optionsUrl: z.string().optional(),\n  filterable: z.boolean().optional(),\n  formEditable: z.boolean().optional(),\n  listVisible: z.boolean().optional(),\n  editor: z.string().optional(),\n  input: z.string().optional(),\n  dictionaryId: z.string().optional(),\n  dictionaryInlineCreate: z.boolean().optional(),\n  priority: z.number().optional(),\n  validation: z.array(z.any()).optional(),\n  defaultValue: z.union([z.string(), z.number(), z.boolean(), z.null()]).optional(),\n  maxAttachmentSizeMb: z.number().optional(),\n  acceptExtensions: z.array(z.any()).optional(),\n  entityId: z.string(),\n  fieldset: z.string().optional(),\n  group: z\n    .object({\n      code: z.string(),\n      title: z.string().optional(),\n      hint: z.string().optional(),\n    })\n    .optional(),\n})\n\nconst customFieldsetGroupResponseSchema = z.object({\n  code: z.string(),\n  title: z.string().optional(),\n  hint: z.string().optional(),\n})\n\nconst entityFieldsetResponseSchema = z.object({\n  code: z.string(),\n  label: z.string(),\n  icon: z.string().optional(),\n  description: z.string().optional(),\n  groups: z.array(customFieldsetGroupResponseSchema).optional(),\n})\n\nconst definitionsResponseSchema = z.object({\n  items: z.array(customFieldDefinitionSchema),\n  fieldsetsByEntity: z.record(z.string(), z.array(entityFieldsetResponseSchema)).optional(),\n  entitySettings: z\n    .record(\n      z.string(),\n      z.object({\n        singleFieldsetPerRecord: z.boolean().optional(),\n      })\n    )\n    .optional(),\n})\n\nconst upsertDefinitionResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string().uuid(),\n    key: z.string(),\n    kind: z.string(),\n    configJson: z.record(z.string(), z.any()),\n    isActive: z.boolean().optional(),\n  }),\n})\n\nconst deleteDefinitionRequestSchema = z.object({\n  entityId: z.string(),\n  key: z.string(),\n})\n\nconst deleteDefinitionResponseSchema = z.object({\n  ok: z.literal(true),\n  version: z.string().nullable().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage custom field definitions',\n  methods: {\n    GET: {\n      summary: 'List active custom field definitions',\n      description: 'Returns active custom field definitions for the supplied entity ids, respecting tenant scope and tombstones.',\n      query: definitionsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Definition list',\n          schema: definitionsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Upsert custom field definition',\n      description: 'Creates or updates a custom field definition for the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: upsertCustomFieldDefSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Definition saved',\n          schema: upsertDefinitionResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failed',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft delete custom field definition',\n      description: 'Marks the specified definition inactive and tombstones it for the current scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteDefinitionRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Definition deleted',\n          schema: deleteDefinitionResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or key',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Definition not found',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\nconst computeDefinitionScore = (def: any, cfg: Record<string, any>, entityIndex: number) => {\n  const listVisibleScore = cfg.listVisible === false ? 0 : 1\n  const formEditableScore = cfg.formEditable === false ? 0 : 1\n  const filterableScore = cfg.filterable ? 1 : 0\n  const kindScore = (() => {\n    switch (def.kind) {\n      case 'dictionary':\n        return 8\n      case 'relation':\n        return 6\n      case 'select':\n      case 'currency':\n        return 4\n      case 'multiline':\n        return 3\n      case 'boolean':\n      case 'integer':\n      case 'float':\n        return 2\n      default:\n        return 1\n    }\n  })()\n  const optionsBonus = Array.isArray(cfg.options) && cfg.options.length ? 2 : 0\n  const dictionaryBonus = typeof cfg.dictionaryId === 'string' && cfg.dictionaryId.trim().length ? 5 : 0\n  const base = (listVisibleScore * 16) + (formEditableScore * 8) + (filterableScore * 4) + kindScore + optionsBonus + dictionaryBonus\n  const penalty = typeof cfg.priority === 'number' ? cfg.priority : 0\n  return { base, penalty, entityIndex }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,cAAc,sBAAsB;AAC7C,SAAS,4BAA4B,yBAAyB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,0CAA0C;AACnD,SAAS,iCAA2D;AACpE,SAAS,wCAAwC;AACjD,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AAErC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAO1E,eAAe,2BACb,OACA,MACA,KACA,IACA,eACwB;AACxB,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,UAAI,OAAO,UAAU,UAAW,QAAO;AACvC,aAAO;AAAA,IACT,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK;AACtD,eAAO;AACT,aAAO;AAAA,IACT,KAAK;AACH,UAAI,OAAO,UAAU,YAAY,CAAC,SAAS,KAAK;AAC9C,eAAO;AACT,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,UAAI,OAAO,UAAU;AACnB,eAAO,oBAAoB,IAAI;AACjC,aAAO;AAAA,IACT,KAAK,cAAc;AACjB,UAAI,OAAO,UAAU;AACnB,eAAO;AACT,YAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,IAAI;AACtF,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,uDAAuD;AAChG,gBAAM,QAAQ,MAAM,GAAG,QAAQ,iBAAiB;AAAA,YAC9C,YAAY;AAAA,YACZ;AAAA,YACA,GAAI,cAAc,iBAAiB,EAAE,gBAAgB,cAAc,eAAe,IAAI,CAAC;AAAA,YACvF,GAAI,cAAc,WAAW,EAAE,UAAU,cAAc,SAAS,IAAI,CAAC;AAAA,UACvE,CAAC;AACD,cAAI,CAAC,MAAO,QAAO,iBAAiB,KAAK;AAAA,QAC3C,SAAS,KAAK;AAEZ,iBAAO,MAAM,6DAAwD,EAAE,IAAI,CAAC;AAAA,QAC9E;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,YAAY;AACf,UAAI,OAAO,UAAU;AACnB,eAAO;AACT,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,MAAM,OAAO,qDAAqD;AACvF,cAAM,QAAgC,EAAE,MAAM,MAAgB;AAC9D,YAAI,cAAc,SAAU,OAAM,WAAW,cAAc;AAC3D,YAAI,cAAc,eAAgB,OAAM,iBAAiB,cAAc;AACvE,cAAM,WAAW,MAAM,GAAG,QAAQ,UAAU,KAAK;AACjD,YAAI,CAAC,SAAU,QAAO,iBAAiB,KAAK;AAAA,MAC9C,SAAS,KAAK;AAEZ,eAAO,MAAM,2DAAsD,EAAE,IAAI,CAAC;AAAA,MAC5E;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,UAAU;AACb,UAAI,OAAO,UAAU,YAAY,OAAO,UAAU;AAChD,eAAO;AACT,YAAM,UAAU;AAAA,QACd,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAAA,MAC9C;AACA,UAAI,QAAQ,SAAS,GAAG;AACtB,cAAM,QAAQ,QAAQ;AAAA,UACpB,CAAC,MAAM,EAAE,UAAU,SAAS,OAAO,EAAE,KAAK,MAAM,OAAO,KAAK;AAAA,QAC9D;AACA,YAAI,CAAC,MAAO,QAAO;AAAA,MACrB;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK;AAAA,IACL,KAAK;AACH,aAAO,qCAAqC,IAAI;AAAA,IAClD;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,4BAA4B,OAAgB,MAAuB;AAC1E,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO,UAAU;AAAA,IACnB,KAAK;AACH,aAAO,KAAK,MAAM,OAAO,KAAK,CAAC;AAAA,IACjC,KAAK;AACH,aAAO,OAAO,KAAK;AAAA,IACrB;AACE,aAAO;AAAA,EACX;AACF;AAEO,MAAM,WAAW;AAAA;AAAA,EAEtB,KAAK,EAAE,aAAa,KAAK;AAAA;AAAA,EAEzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEA,SAAS,eAAe,KAAoB;AAC1C,QAAM,SAAS,IAAI,aAAa,OAAO,UAAU,EAAE,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,SAAS,CAAC;AAChH,QAAM,WAAW,IAAI,aAAa,IAAI,WAAW;AACjD,MAAI,UAAU;AACZ,aACG,MAAM,GAAG,EACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,EACrB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,EAC5B,QAAQ,CAAC,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,EACpC;AACA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,MAAM,QAAQ;AACvB,QAAI,KAAK,IAAI,EAAE,EAAG;AAClB,SAAK,IAAI,EAAE;AACX,WAAO,KAAK,EAAE;AAAA,EAChB;AACA,SAAO;AACT;AAEA,eAAe,2BAA2B,IAAS,UAAkB,UAAkE;AACrI,MAAI;AACF,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAc;AAAA,MACzC;AAAA,MACA,MAAM;AAAA,QACJ,EAAE,KAAK,CAAE,EAAE,UAAU,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,MAC5E;AAAA,IACF,CAAQ;AACR,QAAI,OAAO,OAAQ,IAAY,kBAAkB,SAAU,QAAQ,IAAY;AAAA,EACjF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAEA,SAAS,oBAAoB,KAA2E;AACtG,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,OAAO,QAAQ,UAAU;AAC3B,UAAMA,QAAO,IAAI,KAAK;AACtB,WAAOA,QAAO,EAAE,MAAAA,MAAK,IAAI;AAAA,EAC3B;AACA,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ;AACd,QAAM,OAAO,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,IAAI;AAClE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAyD,EAAE,KAAK;AACtE,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,KAAK,EAAG,OAAM,QAAQ,MAAM,MAAM,KAAK;AAC1F,MAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,EAAG,OAAM,OAAO,MAAM,KAAK,KAAK;AACtF,SAAO;AACT;AAEA,SAAS,2BACP,YACA,OACA;AACA,QAAM,qBAAqB,WAAW,YAAY;AAClD,QAAM,2BAA2B,WAAW,kBAAkB;AAC9D,QAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,MAAM;AAClF,QAAM,sBACJ,6BAA6B,QAC5B,MAAM,mBAAmB,QAAQ,6BAA6B,MAAM;AACvE,SAAO,iBAAiB;AAC1B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,qBAAqB,eAAe,GAAG;AAC7C,MAAI,CAAC,mBAAmB,QAAQ;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,oBAAoB,IAAI,aAAa,IAAI,UAAU;AACzD,QAAM,iBAAiB,qBAAqB,kBAAkB,KAAK,EAAE,SAAS,kBAAkB,KAAK,IAAI;AAEzG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,gCAAgC,kBAAkB;AACpE,MAAI,CAAC,UAAU,QAAQ;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAAA,EACxC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,kBAAkB,4CAA4C,MAAM,KAAK;AAC/E,QAAM,WAAW,gBAAgB;AACjC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,gBAAgB;AACvC,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AAET,MAAI,uBAAuB;AAC3B,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,GAAG;AACvD,QAAI;AACF,YAAM,OAAO,QAAQ,aAAa;AAClC,6BAAuB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,6BAA6B,GAAG;AAAA,QAC9F;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,sBAAsB;AACxB,QAAI;AACF,YAAM,iCAAiC,IAAI,OAAO;AAAA,QAChD,WAAW,CAAC,QAAQ;AAAA,QACpB;AAAA,QACA,eAAe;AAAA,QACf,YAAY;AAAA,MACd,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,KAAK,mDAAmD;AAAA,QAC7D;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,WAA0B;AAC9B,MAAI,SAAS,CAAC,gBAAgB;AAC5B,eAAW,0BAA0B;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI;AACF,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,QAAQ;AACV,eAAO,aAAa,KAAK,MAAM;AAAA,MACjC;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,wBAAwB,EAAE,IAAI,CAAC;AAAA,IAC7C;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,0BAA0B,IAAI;AAAA,IAC1D;AAAA,IACA;AAAA,IACA;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AAED,QAAM,mBAAmB,CAAC,EAAE,SAAS,GAAG,EAAE,UAAU,KAAsB,CAAC;AAC3E,QAAM,yBAAyB,CAAC,EAAE,gBAAgB,KAAsB,CAAC;AACzE,MAAI,eAAgB,wBAAuB,QAAQ,EAAE,eAAe,CAAC;AACrE,QAAM,YAAY,EAAE,UAAU,eAAe;AAE7C,QAAM,cAAc;AAAA,IAClB,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW;AAAA,IACX,MAAM;AAAA,MACJ,EAAE,KAAK,iBAAiB;AAAA,MACxB,EAAE,KAAK,uBAAuB;AAAA,IAChC;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,GAAG,KAAK,gBAAgB,WAAkB,GAC3D,OAAO,CAAC,eAAoB,2BAA2B,YAAY,SAAS,CAAC;AAChF,QAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,IAChD,UAAU,EAAE,KAAK,UAAiB;AAAA,IAClC,WAAW,EAAE,KAAK,KAAK;AAAA,IACvB,MAAM;AAAA,MACJ,EAAE,KAAK,iBAAiB;AAAA,MACxB,EAAE,KAAK,uBAAuB;AAAA,IAChC;AAAA,EACF,CAAQ,GAAG,OAAO,CAAC,eAAoB,2BAA2B,YAAY,SAAS,CAAC;AAExF,QAAM,qBAAqB,oBAAI,IAAyB;AACxD,aAAW,SAAS,YAAqB;AACvC,UAAM,MAAM,OAAO,MAAM,QAAQ;AACjC,QAAI,CAAC,mBAAmB,IAAI,GAAG,EAAG,oBAAmB,IAAI,KAAK,oBAAI,IAAI,CAAC;AACvE,uBAAmB,IAAI,GAAG,EAAG,IAAI,MAAM,GAAG;AAAA,EAC5C;AAEA,QAAM,aAAa,CAAC,OAAY,EAAE,WAAW,IAAI,MAAM,EAAE,iBAAiB,IAAI;AAE9E,QAAM,sBAAsB,oBAAI,IAAmB;AACnD,aAAW,KAAK,MAAM;AACpB,UAAM,MAAM,OAAO,EAAE,QAAQ;AAC7B,QAAI,CAAC,oBAAoB,IAAI,GAAG,EAAG,qBAAoB,IAAI,KAAK,CAAC,CAAC;AAClE,wBAAoB,IAAI,GAAG,EAAG,KAAK,CAAC;AAAA,EACtC;AAEA,QAAM,uBAAuB,oBAAI,IAAgC;AACjE,aAAW,YAAY,WAAW;AAChC,UAAM,SAAS,MAAM,2BAA2B,IAAI,UAAU,YAAY,IAAI;AAC9E,yBAAqB,IAAI,UAAU,MAAM;AAAA,EAC3C;AAEA,QAAM,QAAe,CAAC;AAEtB,QAAM,cAAc,oBAAI,IAAoB;AAC5C,YAAU,QAAQ,CAAC,IAAI,QAAQ,YAAY,IAAI,IAAI,GAAG,CAAC;AAEvD,aAAW,YAAY,WAAW;AAChC,UAAM,gBAAgB,oBAAoB,IAAI,QAAQ,KAAK,CAAC;AAC5D,QAAI,CAAC,cAAc,OAAQ;AAC3B,UAAM,iBAAiB,mBAAmB,IAAI,QAAQ,KAAK,oBAAI,IAAY;AAC3E,UAAM,QAAQ,oBAAI,IAAiB;AACnC,eAAW,KAAK,eAAe;AAC7B,YAAM,WAAW,MAAM,IAAI,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AAAE,cAAM,IAAI,EAAE,KAAK,CAAC;AAAG;AAAA,MAAS;AAC/C,YAAM,OAAO,WAAW,CAAC;AACzB,YAAM,OAAO,WAAW,QAAQ;AAChC,UAAI,OAAO,MAAM;AAAE,cAAM,IAAI,EAAE,KAAK,CAAC;AAAG;AAAA,MAAS;AACjD,UAAI,OAAO,KAAM;AACjB,YAAM,OAAQ,EAAE,qBAAqB,OAAQ,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AACnG,YAAM,OAAQ,SAAS,qBAAqB,OAAQ,SAAS,UAAU,QAAQ,IAAI,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACxH,UAAI,QAAQ,KAAM,OAAM,IAAI,EAAE,KAAK,CAAC;AAAA,IACtC;AAEA,UAAM,gBAAgB,qBAAqB,IAAI,QAAQ;AACvD,UAAM,UAAU,MAAM,KAAK,MAAM,OAAO,CAAC,EAAE,OAAO,CAAC,MAAY,EAAE,aAAa,SAAU,CAAC,eAAe,IAAI,EAAE,GAAG,CAAC;AAClH,YAAQ,KAAK,CAAC,GAAQ,OAAa,EAAE,YAAY,YAAY,MAAM,EAAE,YAAY,YAAY,EAAG;AAEhG,eAAW,KAAK,SAAS;AACvB,YAAM,cAAc,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,SAAS,KAAK,IAAI;AAChG,YAAM,qBAAqB,YAAY,SAAS,IAAI,cAAc;AAClE,YAAM,sBAAsB,MAAM,QAAQ,EAAE,YAAY,SAAS,IAC7D,EAAE,WAAW,UACV,OAAO,CAAC,UAAoC,OAAO,UAAU,QAAQ,EACrE,IAAI,CAAC,UAAkB,MAAM,KAAK,CAAC,EACnC,OAAO,CAAC,UAAkB,MAAM,SAAS,CAAC,IAC7C,CAAC;AACL,YAAM,qBAAqB,oBAAoB,SAAS,IACpD,sBACC,qBAAqB,CAAC,kBAAkB,IAAI,CAAC;AAClD,UAAI,kBAAkB,CAAC,mBAAmB,SAAS,cAAc,EAAG;AACpE,YAAM,YAAY,oBAAoB,EAAE,YAAY,KAAK;AACzD,YAAM,WAAW,OAAO,EAAE,GAAG,EAAE,YAAY;AAC3C,YAAM,gBAAgB;AAAA,QACpB,KAAK,EAAE;AAAA,QACP,MAAM,EAAE;AAAA,QACR,OAAO,EAAE,YAAY,SAAS,EAAE;AAAA,QAChC,aAAa,EAAE,YAAY,eAAe;AAAA,QAC1C,OAAO,QAAQ,EAAE,YAAY,KAAK;AAAA,QAClC,UAAU,MAAM;AACd,cAAI,EAAE,SAAS,WAAY,QAAO;AAClC,gBAAM,oBAAoB,4BAA4B,EAAE,YAAY,OAAO;AAC3E,iBAAO,kBAAkB,SAAS,oBAAoB;AAAA,QACxD,GAAG;AAAA,QACH,aAAa,MAAM;AACjB,cAAI,EAAE,SAAS,WAAY,QAAO;AAClC,gBAAM,eAAe,OAAO,EAAE,YAAY,iBAAiB,WAAW,EAAE,WAAW,eAAe;AAClG,cAAI,aAAc,QAAO,qBAAqB,YAAY;AAC1D,iBAAO,OAAO,EAAE,YAAY,eAAe,WAAW,EAAE,WAAW,aAAa;AAAA,QAClF,GAAG;AAAA,QACH,YAAY,QAAQ,EAAE,YAAY,UAAU;AAAA,QAC5C,cAAc,EAAE,YAAY,iBAAiB,SAAY,QAAQ,EAAE,WAAW,YAAY,IAAI;AAAA,QAC9F,aAAa,EAAE,YAAY,gBAAgB,SAAY,QAAQ,EAAE,WAAW,WAAW,IAAI;AAAA,QAC3F,QAAQ,OAAO,EAAE,YAAY,WAAW,WACpC,EAAE,WAAW,SACZ,EAAE,SAAS,cAAc,gBAAgB;AAAA,QAC9C,OAAO,OAAO,EAAE,YAAY,UAAU,WAAW,EAAE,WAAW,QAAQ;AAAA,QACtE,cAAc,OAAO,EAAE,YAAY,iBAAiB,WAAW,EAAE,WAAW,eAAe;AAAA,QAC3F,wBAAwB,EAAE,YAAY,2BAA2B,SAC7D,QAAQ,EAAE,WAAW,sBAAsB,IAC3C;AAAA,QACJ,UAAU,OAAO,EAAE,YAAY,aAAa,WAAW,EAAE,WAAW,WAAW;AAAA,QAC/E,YAAY,MAAM,QAAQ,EAAE,YAAY,UAAU,IAAI,EAAE,WAAW,aAAa;AAAA,QAChF,cAAc,EAAE,YAAY,iBAAiB,SAAY,EAAE,WAAW,eAAe;AAAA;AAAA,QAErF,qBAAqB,OAAO,EAAE,YAAY,wBAAwB,WAAW,EAAE,WAAW,sBAAsB;AAAA,QAChH,kBAAkB,MAAM,QAAQ,EAAE,YAAY,gBAAgB,IAAI,EAAE,WAAW,mBAAmB;AAAA;AAAA,QAElG,oBAAoB,OAAO,EAAE,YAAY,uBAAuB,WAAW,EAAE,WAAW,qBAAqB;AAAA,QAC7G;AAAA,QACA,UAAU,sBAAsB,mBAAmB,CAAC;AAAA,QACpD,WAAW,mBAAmB,SAAS,IAAI,qBAAqB;AAAA,QAChE,OAAO;AAAA,MACT;AACA,YAAM,UAAU,uBAAuB,GAAG,eAAe,YAAY,IAAI,QAAQ,KAAK,OAAO,gBAAgB;AAC7G,YAAM,YAAY,EAAE,GAAG,eAAe,SAAS,QAAQ;AACvD,YAAM,WAAY,MAAgB,KAAK,CAAC,UAAU,MAAM,IAAI,YAAY,MAAM,QAAQ;AACtF,UAAI,CAAC,UAAU;AACb,cAAM,KAAK,SAAS;AACpB;AAAA,MACF;AACA,YAAM,gBAAgB,SAAS;AAC/B,YAAM,qBAAqB,UAAU;AACrC,YAAM,SACJ,mBAAmB,OAAO,cAAc,QACvC,mBAAmB,SAAS,cAAc,QAAQ,mBAAmB,UAAU,cAAc,WAC7F,mBAAmB,SAAS,cAAc,QAAQ,mBAAmB,YAAY,cAAc,WAAW,mBAAmB,cAAc,cAAc;AAC5J,UAAI,QAAQ;AACV,cAAM,QAAQ,MAAM,UAAU,CAAC,UAAU,MAAM,IAAI,YAAY,MAAM,QAAQ;AAC7E,YAAI,SAAS,EAAG,OAAM,KAAK,IAAI;AAAA,MACjC;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,IAAI,CAAC,SAAc;AACzC,UAAM,EAAE,SAAS,GAAG,KAAK,IAAI;AAC7B,WAAO;AAAA,EACT,CAAC;AACD,YAAU,KAAK,CAAC,GAAQ,OAAa,EAAE,YAAY,MAAM,EAAE,YAAY,EAAG;AAE1E,QAAM,oBAAgE,CAAC;AACvE,QAAM,iBAAuE,CAAC;AAC9E,aAAW,YAAY,WAAW;AAChC,UAAM,MAAM,gBAAgB,IAAI,QAAQ,KAAK,EAAE,WAAW,CAAC,GAAG,yBAAyB,KAAK;AAC5F,sBAAkB,QAAQ,IAAI,IAAI;AAClC,mBAAe,QAAQ,IAAI,EAAE,yBAAyB,IAAI,wBAAwB;AAAA,EACpF;AAEA,QAAM,eAAe,EAAE,OAAO,WAAW,mBAAmB,eAAe;AAE3E,MAAI,SAAS,YAAY,CAAC,gBAAgB;AACxC,UAAM,OAAO,2BAA2B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI;AACF,YAAM,MAAM,IAAI,UAAU,cAAc;AAAA,QACtC,KAAK;AAAA,QACL;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,KAAK,+BAA+B,EAAE,IAAI,CAAC;AAAA,IACpD;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,YAAY;AACvC;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,QAAQ,OAAO;AAErB,MAAI,CAAC,yBAAyB,MAAM,QAAQ,GAAG;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,kDAAkD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxG;AAEA,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,eAAe,MAAM,YAAY;AACvC,QAAI,OAAO,iBAAiB,YAAY,aAAa,KAAK,EAAE,WAAW,GAAG;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,wDAAwD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9G;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,+BAA+B,EAAE,MAAM,WAAW,SAAS,IAAI,CAAC;AACpF,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AAET,QAAM,QAAa,2BAA2B,MAAM,UAAU,MAAM,KAAK,KAAK;AAC9E,MAAI,MAAM,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AAEhD,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,MAAM,IAAI,KAAK,GAAG,MAAM,QAAQ,IAAI,MAAM,GAAG;AAAA,IACzD,WAAW,MAAM,WAAW;AAAA,IAC5B,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,CAAC,IAAK,OAAM,GAAG,OAAO,gBAAgB,EAAE,GAAG,OAAO,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC7E,MAAI,OAAO,MAAM;AACjB,QAAM,QAAS,MAAc,cAAc,CAAC;AAC5C,QAAM,MAA2B,EAAE,GAAG,MAAM;AAC5C,MAAI,IAAI,SAAS,QAAQ,OAAO,IAAI,KAAK,EAAE,KAAK,MAAM,GAAI,KAAI,QAAQ,MAAM;AAC5E,MAAI,IAAI,iBAAiB,OAAW,KAAI,eAAe;AACvD,MAAI,IAAI,gBAAgB,OAAW,KAAI,cAAc;AACrD,MAAI,MAAM,SAAS,cAAc;AAC/B,UAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,aAAa,KAAK,IAAI;AACtF,QAAI,eAAe;AACnB,QAAI,yBAAyB,IAAI,2BAA2B;AAAA,EAC9D;AACA,MAAI,MAAM,SAAS,YAAY;AAC7B,QAAI,aAAa;AACjB,QAAI,MAAM,QAAQ,IAAI,OAAO,EAAG,QAAO,IAAI;AAAA,EAC7C;AACA,MAAI,MAAM,SAAS,gBAAgB,IAAI,UAAU,QAAQ,OAAO,IAAI,MAAM,EAAE,KAAK,MAAM,KAAK;AAC1F,QAAI,SAAS;AAAA,EACf;AAEA,MAAI,IAAI,iBAAiB,UAAa,IAAI,iBAAiB,MAAM;AAC/D,UAAM,kBAAkB,MAAM;AAAA,MAC5B,IAAI;AAAA,MAAc,MAAM;AAAA,MAAM;AAAA,MAAK;AAAA,MACnC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AACA,QAAI,iBAAiB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtE;AACA,QAAI,eAAe,4BAA4B,IAAI,cAAc,MAAM,IAAI;AAAA,EAC7E;AACA,MAAI,aAAa;AACjB,MAAI,WAAW,MAAM,YAAY;AACjC,MAAI,YAAY,IAAI,aAAa,QAAS,IAAI,aAAa,oBAAI,KAAK,IAAK;AACzE,MAAI,YAAY,oBAAI,KAAK;AACzB,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAC5B,QAAM,2BAA2B,OAAO;AAAA,IACtC,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW,CAAC,MAAM,QAAQ;AAAA,EAC5B,CAAC;AAED,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,IAAI,IAAI,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,MAAM,YAAY,IAAI,YAAY,UAAU,IAAI,SAAS,EAAE,CAAC;AAC/I;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,EAAE,UAAU,IAAI,IAAI,QAAQ,CAAC;AACnC,MAAI,CAAC,YAAY,CAAC,IAAK,QAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,+BAA+B,EAAE,MAAM,WAAW,SAAS,IAAI,CAAC;AACpF,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,YAAQ,QAAQ,OAAO;AAAA,EACzB,QAAQ;AAAA,EAAC;AACT,QAAM,QAAa,2BAA2B,UAAU,KAAK,KAAK;AAClE,MAAI,MAAM,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AAChD,MAAI,YAAwB;AAC5B,MAAI,CAAC,KAAK;AACR,gBAAY,8BAA8B,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACtE;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,WAAW,MAAM,UAAU,KAAK;AAAA,IACpC,CAAC,CAAC;AACF,QAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,KAAK,MAAM,WAAW,MAAM,GAAG,QAAQ,IAAI,GAAG;AAAA,IAC1D,WAAW;AAAA,IACX,iBAAiB,EAAE,UAAU,IAAI;AAAA,EACnC,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,CAAC,KAAK;AACR,UAAM,gCAAgC,IAAI,WAAW,KAAK;AAAA,EAC5D,OAAO;AACL,6BAAyB,GAAG;AAAA,EAC9B;AACA,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAC5B,QAAM,2BAA2B,OAAO;AAAA,IACtC,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW,CAAC,QAAQ;AAAA,EACtB,CAAC;AAID,QAAM,UAAU,MAAM,gCAAgC,IAAI;AAAA,IACxD;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,CAAC;AAChD;AAEA,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EAC9D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AACzD,CAAC,EACA;AAAA,EACC,CAAC,UAAU;AACT,QAAI,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,MAAM,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO;AACrG,QAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,EAAG,QAAO;AACvE,WAAO,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,KAAK,EAAE,SAAS;AAAA,EAChF;AAAA,EACA,EAAE,SAAS,sDAAsD;AACnE;AAEF,MAAM,+BAA+B,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC;AAErE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,MAAM,4BAA4B,EAAE,SAAS;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,EAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EAChF,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,OAAO,EACJ,OAAO;AAAA,IACN,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACjD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,MAAM,iCAAiC,EAAE,SAAS;AAC9D,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,2BAA2B;AAAA,EAC1C,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,4BAA4B,CAAC,EAAE,SAAS;AAAA,EACxF,gBAAgB,EACb;AAAA,IACC,EAAE,OAAO;AAAA,IACT,EAAE,OAAO;AAAA,MACP,yBAAyB,EAAE,QAAQ,EAAE,SAAS;AAAA,IAChD,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAAA,IACxC,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,UAAU,EAAE,OAAO;AAAA,EACnB,KAAK,EAAE,OAAO;AAChB,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC1C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AACA,MAAM,yBAAyB,CAAC,KAAU,KAA0B,gBAAwB;AAC1F,QAAM,mBAAmB,IAAI,gBAAgB,QAAQ,IAAI;AACzD,QAAM,oBAAoB,IAAI,iBAAiB,QAAQ,IAAI;AAC3D,QAAM,kBAAkB,IAAI,aAAa,IAAI;AAC7C,QAAM,aAAa,MAAM;AACvB,YAAQ,IAAI,MAAM;AAAA,MAChB,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF,GAAG;AACH,QAAM,eAAe,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,IAAI;AAC5E,QAAM,kBAAkB,OAAO,IAAI,iBAAiB,YAAY,IAAI,aAAa,KAAK,EAAE,SAAS,IAAI;AACrG,QAAM,OAAQ,mBAAmB,KAAO,oBAAoB,IAAM,kBAAkB,IAAK,YAAY,eAAe;AACpH,QAAM,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAClE,SAAO,EAAE,MAAM,SAAS,YAAY;AACtC;",
   "names": ["code"]
 }

package/dist/modules/entities/lib/helpers.js

@@ -10,6 +10,7 @@ function columnFromKind(kind) {
     case "select":
     case "currency":
     case "dictionary":
+    case "phone":
       return "valueText";
     case "multiline":
       return "valueMultiline";

package/dist/modules/entities/lib/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/lib/helpers.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport {\n  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,\n  TOO_MANY_CUSTOM_FIELDS_ERROR,\n} from '@open-mercato/shared/modules/entities/validation'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      isActive: true,\n      deletedAt: null,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing) {\n        defsByKey[d.key] = d\n        continue\n      }\n      const nextScore = scopeScore(d)\n      const existingScore = scopeScore(existing)\n      if (nextScore > existingScore) {\n        defsByKey[d.key] = d\n        continue\n      }\n      if (nextScore < existingScore) continue\n\n      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const existingUpdatedAt = existing.updatedAt instanceof Date\n        ? existing.updatedAt.getTime()\n        : new Date(existing.updatedAt).getTime()\n      if (nextUpdatedAt >= existingUpdatedAt) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  const presentKeyCount = keys.filter((key) => values[key] !== undefined).length\n  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {\n    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)\n  }\n\n  // Run the per-key delete+insert work inside ONE database transaction so a\n  // multi-value replacement is atomic and isolated. The array branch deletes the\n  // existing rows for a key and inserts the replacements; without an enclosing\n  // transaction those can land in separate commit boundaries under MikroORM's\n  // FlushMode.AUTO (a query elsewhere in the unit auto-flushes part of the work),\n  // which intermittently left the field with the delete applied but the inserts\n  // missing \u2014 the multi-select EDIT reverted to []. The single commit below makes\n  // it all-or-nothing. We only open our own transaction when the caller has not\n  // already started one (commands fork the request em and may run setCustomFields\n  // outside their own withAtomicFlush tx); join an ambient transaction otherwise.\n  const txEm = em as {\n    begin?: () => Promise<void>\n    commit?: () => Promise<void>\n    rollback?: () => Promise<void>\n    isInTransaction?: () => boolean\n  }\n  const txCapable =\n    typeof txEm.begin === 'function' &&\n    typeof txEm.commit === 'function' &&\n    typeof txEm.rollback === 'function' &&\n    typeof txEm.isInTransaction === 'function'\n  const ownCustomFieldTransaction = txCapable && !txEm.isInTransaction!()\n  if (ownCustomFieldTransaction) await txEm.begin!()\n  try {\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array (multi-value): replace all existing rows for the key. Delete\n    // first, then create replacements, all inside the transaction opened above.\n    // Creating rows before a native delete can auto-flush and delete the new\n    // values; mixing em.remove(stale) with new rows for the same EAV scope was\n    // observed to commit an empty set under MikroORM v7. The explicit order keeps\n    // the replacement atomic without letting old-row cleanup target new rows.\n    if (isArray) {\n      const arr = raw as Primitive[]\n      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        toPersist.push(cf)\n      }\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n    if (ownCustomFieldTransaction) await txEm.commit!()\n  } catch (err) {\n    if (ownCustomFieldTransaction) {\n      try { await txEm.rollback!() } catch { /* surface the original error, not a rollback failure */ }\n    }\n    throw err\n  }\n  // Emit hook for indexing if requested (outside CRUD flows). Runs AFTER the\n  // transaction commits so consumers observe the persisted rows.\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AACD,UAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,YAAM,YAAY,WAAW,CAAC;AAC9B,YAAM,gBAAgB,WAAW,QAAQ;AACzC,UAAI,YAAY,eAAe;AAC7B,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,UAAI,YAAY,cAAe;AAE/B,YAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,YAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,UAAI,iBAAiB,mBAAmB;AACtC,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,QAAM,kBAAkB,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS,EAAE;AACxE,MAAI,cAAc,kBAAkB,kCAAkC;AACpE,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAYA,QAAM,OAAO;AAMb,QAAM,YACJ,OAAO,KAAK,UAAU,cACtB,OAAO,KAAK,WAAW,cACvB,OAAO,KAAK,aAAa,cACzB,OAAO,KAAK,oBAAoB;AAClC,QAAM,4BAA4B,aAAa,CAAC,KAAK,gBAAiB;AACtE,MAAI,0BAA2B,OAAM,KAAK,MAAO;AACjD,MAAI;AACJ,eAAW,YAAY,MAAM;AAC3B,YAAM,MAAM,OAAO,QAAQ;AAC3B,UAAI,QAAQ,OAAW;AAEvB,YAAM,MAAM,YAAY,QAAQ;AAChC,YAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,YAAM,UAAU,MAAM,QAAQ,GAAG;AAOjC,UAAI,SAAS;AACX,cAAM,MAAM;AACZ,cAAM,GAAG,aAAa,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAClG,mBAAW,OAAO,KAAK;AACrB,gBAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,gBAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,4BAAkBA,GAAE;AACpB,gBAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,kBAAQ,KAAK;AAAA,YACX,KAAK;AAAa,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACzE,KAAK;AAAkB,cAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACnF,KAAK;AAAY,cAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACvE,KAAK;AAAc,cAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YAC3E,KAAK;AAAa,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,YAC1E;AAAS,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAClE;AACA,oBAAU,KAAKA,GAAE;AAAA,QACnB;AACA;AAAA,MACF;AAEA,YAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,YAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,UAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,UAAI,CAAC,IAAI;AACP,aAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,kBAAU,KAAK,EAAE;AAAA,MACnB;AACA,wBAAkB,EAAE;AACpB,cAAQ,QAAQ;AAAA,QACd,KAAK;AACH,aAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,QACF,KAAK;AACH,aAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,QACF,KAAK;AACH,aAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,QACF,KAAK;AACH,aAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,QACF,KAAK;AACH,aAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,QACF;AACE,aAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACJ;AAAA,IACF;AAEA,QAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,UAAM,GAAG,MAAM;AACb,QAAI,0BAA2B,OAAM,KAAK,OAAQ;AAAA,EACpD,SAAS,KAAK;AACZ,QAAI,2BAA2B;AAC7B,UAAI;AAAE,cAAM,KAAK,SAAU;AAAA,MAAE,QAAQ;AAAA,MAA2D;AAAA,IAClG;AACA,UAAM;AAAA,EACR;AAGA,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { encryptCustomFieldValue, resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport {\n  MAX_CUSTOM_FIELD_KEYS_PER_RECORD,\n  TOO_MANY_CUSTOM_FIELDS_ERROR,\n} from '@open-mercato/shared/modules/entities/validation'\nimport { CustomFieldDef, CustomFieldValue } from '../data/entities'\n\ntype Primitive = string | number | boolean | null | undefined\ntype PrimitiveOrArray = Primitive | Primitive[]\n\nexport type SetRecordCustomFieldsOptions = {\n  entityId: string\n  recordId: string\n  organizationId?: string | null\n  tenantId?: string | null\n  values: Record<string, PrimitiveOrArray>\n  // When true (default), try to use field definitions to decide storage column\n  preferDefs?: boolean\n  // Optional: notify external systems (e.g., indexing) when values changed\n  onChanged?: (payload: { entityId: string; recordId: string; organizationId: string | null; tenantId: string | null }) => Promise<void> | void\n  // Optional: re-use an existing tenant encryption service instance\n  encryptionService?: TenantDataEncryptionService | null\n}\n\nfunction columnFromKind(kind: string): keyof CustomFieldValue {\n  switch (kind) {\n    case 'text':\n    case 'select':\n    case 'currency':\n    case 'dictionary':\n    case 'phone':\n      return 'valueText'\n    case 'multiline':\n      return 'valueMultiline'\n    case 'integer':\n      return 'valueInt'\n    case 'float':\n      return 'valueFloat'\n    case 'boolean':\n      return 'valueBool'\n    default:\n      return 'valueText'\n  }\n}\n\nfunction columnFromJsValue(v: Primitive): keyof CustomFieldValue {\n  if (v === null || v === undefined) return 'valueText'\n  if (typeof v === 'boolean') return 'valueBool'\n  if (typeof v === 'number') return Number.isInteger(v) ? 'valueInt' : 'valueFloat'\n  return 'valueText'\n}\n\n// Clears all value columns to avoid leftovers on update\nfunction clearValueColumns(cf: CustomFieldValue) {\n  cf.valueText = null\n  cf.valueMultiline = null\n  cf.valueInt = null\n  cf.valueFloat = null\n  cf.valueBool = null\n}\n\nexport async function setRecordCustomFields(\n  em: EntityManager,\n  opts: SetRecordCustomFieldsOptions,\n): Promise<void> {\n  const { entityId, recordId, values } = opts\n  const organizationId = opts.organizationId ?? null\n  const tenantId = opts.tenantId ?? null\n  const preferDefs = opts.preferDefs !== false\n\n  let defsByKey: Record<string, CustomFieldDef> | undefined\n  if (preferDefs) {\n    const defs = await em.find(CustomFieldDef, {\n      entityId,\n      isActive: true,\n      deletedAt: null,\n      organizationId: { $in: [organizationId, null] as any },\n      tenantId: { $in: [tenantId, null] as any },\n    })\n    const scopeScore = (def: CustomFieldDef) => (def.tenantId ? 2 : 0) + (def.organizationId ? 1 : 0)\n    defsByKey = {}\n    for (const d of defs) {\n      const existing = defsByKey[d.key]\n      if (!existing) {\n        defsByKey[d.key] = d\n        continue\n      }\n      const nextScore = scopeScore(d)\n      const existingScore = scopeScore(existing)\n      if (nextScore > existingScore) {\n        defsByKey[d.key] = d\n        continue\n      }\n      if (nextScore < existingScore) continue\n\n      const nextUpdatedAt = d.updatedAt instanceof Date ? d.updatedAt.getTime() : new Date(d.updatedAt).getTime()\n      const existingUpdatedAt = existing.updatedAt instanceof Date\n        ? existing.updatedAt.getTime()\n        : new Date(existing.updatedAt).getTime()\n      if (nextUpdatedAt >= existingUpdatedAt) {\n        defsByKey[d.key] = d\n      }\n    }\n  }\n\n  const toPersist: CustomFieldValue[] = []\n  let encryptionService: TenantDataEncryptionService | null | undefined\n  const encryptionCache = new Map<string | null, string | null>()\n  const getEncryptionService = () => {\n    if (encryptionService !== undefined) return encryptionService\n    encryptionService = resolveTenantEncryptionService(em as any, opts.encryptionService)\n    return encryptionService\n  }\n  const keys = Object.keys(values)\n  const presentKeyCount = keys.filter((key) => values[key] !== undefined).length\n  if (preferDefs && presentKeyCount > MAX_CUSTOM_FIELD_KEYS_PER_RECORD) {\n    throw new Error(TOO_MANY_CUSTOM_FIELDS_ERROR)\n  }\n\n  // Run the per-key delete+insert work inside ONE database transaction so a\n  // multi-value replacement is atomic and isolated. The array branch deletes the\n  // existing rows for a key and inserts the replacements; without an enclosing\n  // transaction those can land in separate commit boundaries under MikroORM's\n  // FlushMode.AUTO (a query elsewhere in the unit auto-flushes part of the work),\n  // which intermittently left the field with the delete applied but the inserts\n  // missing \u2014 the multi-select EDIT reverted to []. The single commit below makes\n  // it all-or-nothing. We only open our own transaction when the caller has not\n  // already started one (commands fork the request em and may run setCustomFields\n  // outside their own withAtomicFlush tx); join an ambient transaction otherwise.\n  const txEm = em as {\n    begin?: () => Promise<void>\n    commit?: () => Promise<void>\n    rollback?: () => Promise<void>\n    isInTransaction?: () => boolean\n  }\n  const txCapable =\n    typeof txEm.begin === 'function' &&\n    typeof txEm.commit === 'function' &&\n    typeof txEm.rollback === 'function' &&\n    typeof txEm.isInTransaction === 'function'\n  const ownCustomFieldTransaction = txCapable && !txEm.isInTransaction!()\n  if (ownCustomFieldTransaction) await txEm.begin!()\n  try {\n  for (const fieldKey of keys) {\n    const raw = values[fieldKey]\n    if (raw === undefined) continue\n\n    const def = defsByKey?.[fieldKey]\n    const encrypted = Boolean(def?.configJson && (def as any).configJson?.encrypted)\n    const isArray = Array.isArray(raw)\n    // When array (multi-value): replace all existing rows for the key. Delete\n    // first, then create replacements, all inside the transaction opened above.\n    // Creating rows before a native delete can auto-flush and delete the new\n    // values; mixing em.remove(stale) with new rows for the same EAV scope was\n    // observed to commit an empty set under MikroORM v7. The explicit order keeps\n    // the replacement atomic without letting old-row cleanup target new rows.\n    if (isArray) {\n      const arr = raw as Primitive[]\n      await em.nativeDelete(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n      for (const val of arr) {\n        const col: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(val)\n        const cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n        clearValueColumns(cf)\n        const stored = encrypted\n          ? await encryptCustomFieldValue(val, tenantId, getEncryptionService(), encryptionCache)\n          : val\n        switch (col) {\n          case 'valueText': cf.valueText = stored == null ? null : String(stored); break\n          case 'valueMultiline': cf.valueMultiline = stored == null ? null : String(stored); break\n          case 'valueInt': cf.valueInt = stored == null ? null : Number(stored); break\n          case 'valueFloat': cf.valueFloat = stored == null ? null : Number(stored); break\n          case 'valueBool': cf.valueBool = stored == null ? null : Boolean(stored); break\n          default: cf.valueText = stored == null ? null : String(stored); break\n        }\n        toPersist.push(cf)\n      }\n      continue\n    }\n\n    const column: keyof CustomFieldValue = encrypted ? 'valueText' : def ? columnFromKind(def.kind) : columnFromJsValue(raw as Primitive)\n    const storedValue = encrypted\n      ? await encryptCustomFieldValue(raw as Primitive, tenantId, getEncryptionService(), encryptionCache)\n      : raw\n\n    let cf = await em.findOne(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey })\n    if (!cf) {\n      cf = em.create(CustomFieldValue, { entityId, recordId, organizationId, tenantId, fieldKey, createdAt: new Date() })\n      toPersist.push(cf)\n    }\n    clearValueColumns(cf)\n    switch (column) {\n      case 'valueText':\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueMultiline':\n        cf.valueMultiline = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n      case 'valueInt':\n        cf.valueInt = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueFloat':\n        cf.valueFloat = (storedValue as Primitive) == null ? null : Number(storedValue as Primitive)\n        break\n      case 'valueBool':\n        cf.valueBool = (storedValue as Primitive) == null ? null : Boolean(storedValue as Primitive)\n        break\n      default:\n        cf.valueText = (storedValue as Primitive) == null ? null : String(storedValue as Primitive)\n        break\n    }\n  }\n\n  if (toPersist.length) em.persist(toPersist)\n  await em.flush()\n    if (ownCustomFieldTransaction) await txEm.commit!()\n  } catch (err) {\n    if (ownCustomFieldTransaction) {\n      try { await txEm.rollback!() } catch { /* surface the original error, not a rollback failure */ }\n    }\n    throw err\n  }\n  // Emit hook for indexing if requested (outside CRUD flows). Runs AFTER the\n  // transaction commits so consumers observe the persisted rows.\n  try {\n    if (typeof opts.onChanged === 'function') {\n      await opts.onChanged({ entityId, recordId, organizationId, tenantId })\n    }\n  } catch {\n    // Non-blocking\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,yBAAyB,sCAAsC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB,wBAAwB;AAmBjD,SAAS,eAAe,MAAsC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,kBAAkB,GAAsC;AAC/D,MAAI,MAAM,QAAQ,MAAM,OAAW,QAAO;AAC1C,MAAI,OAAO,MAAM,UAAW,QAAO;AACnC,MAAI,OAAO,MAAM,SAAU,QAAO,OAAO,UAAU,CAAC,IAAI,aAAa;AACrE,SAAO;AACT;AAGA,SAAS,kBAAkB,IAAsB;AAC/C,KAAG,YAAY;AACf,KAAG,iBAAiB;AACpB,KAAG,WAAW;AACd,KAAG,aAAa;AAChB,KAAG,YAAY;AACjB;AAEA,eAAsB,sBACpB,IACA,MACe;AACf,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI;AACvC,QAAM,iBAAiB,KAAK,kBAAkB;AAC9C,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,aAAa,KAAK,eAAe;AAEvC,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,OAAO,MAAM,GAAG,KAAK,gBAAgB;AAAA,MACzC;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAS;AAAA,MACrD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAS;AAAA,IAC3C,CAAC;AACD,UAAM,aAAa,CAAC,SAAyB,IAAI,WAAW,IAAI,MAAM,IAAI,iBAAiB,IAAI;AAC/F,gBAAY,CAAC;AACb,eAAW,KAAK,MAAM;AACpB,YAAM,WAAW,UAAU,EAAE,GAAG;AAChC,UAAI,CAAC,UAAU;AACb,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,YAAM,YAAY,WAAW,CAAC;AAC9B,YAAM,gBAAgB,WAAW,QAAQ;AACzC,UAAI,YAAY,eAAe;AAC7B,kBAAU,EAAE,GAAG,IAAI;AACnB;AAAA,MACF;AACA,UAAI,YAAY,cAAe;AAE/B,YAAM,gBAAgB,EAAE,qBAAqB,OAAO,EAAE,UAAU,QAAQ,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ;AAC1G,YAAM,oBAAoB,SAAS,qBAAqB,OACpD,SAAS,UAAU,QAAQ,IAC3B,IAAI,KAAK,SAAS,SAAS,EAAE,QAAQ;AACzC,UAAI,iBAAiB,mBAAmB;AACtC,kBAAU,EAAE,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,YAAgC,CAAC;AACvC,MAAI;AACJ,QAAM,kBAAkB,oBAAI,IAAkC;AAC9D,QAAM,uBAAuB,MAAM;AACjC,QAAI,sBAAsB,OAAW,QAAO;AAC5C,wBAAoB,+BAA+B,IAAW,KAAK,iBAAiB;AACpF,WAAO;AAAA,EACT;AACA,QAAM,OAAO,OAAO,KAAK,MAAM;AAC/B,QAAM,kBAAkB,KAAK,OAAO,CAAC,QAAQ,OAAO,GAAG,MAAM,MAAS,EAAE;AACxE,MAAI,cAAc,kBAAkB,kCAAkC;AACpE,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAYA,QAAM,OAAO;AAMb,QAAM,YACJ,OAAO,KAAK,UAAU,cACtB,OAAO,KAAK,WAAW,cACvB,OAAO,KAAK,aAAa,cACzB,OAAO,KAAK,oBAAoB;AAClC,QAAM,4BAA4B,aAAa,CAAC,KAAK,gBAAiB;AACtE,MAAI,0BAA2B,OAAM,KAAK,MAAO;AACjD,MAAI;AACJ,eAAW,YAAY,MAAM;AAC3B,YAAM,MAAM,OAAO,QAAQ;AAC3B,UAAI,QAAQ,OAAW;AAEvB,YAAM,MAAM,YAAY,QAAQ;AAChC,YAAM,YAAY,QAAQ,KAAK,cAAe,IAAY,YAAY,SAAS;AAC/E,YAAM,UAAU,MAAM,QAAQ,GAAG;AAOjC,UAAI,SAAS;AACX,cAAM,MAAM;AACZ,cAAM,GAAG,aAAa,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AAClG,mBAAW,OAAO,KAAK;AACrB,gBAAM,MAA8B,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAG;AACpH,gBAAMA,MAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AACxH,4BAAkBA,GAAE;AACpB,gBAAM,SAAS,YACX,MAAM,wBAAwB,KAAK,UAAU,qBAAqB,GAAG,eAAe,IACpF;AACJ,kBAAQ,KAAK;AAAA,YACX,KAAK;AAAa,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACzE,KAAK;AAAkB,cAAAA,IAAG,iBAAiB,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACnF,KAAK;AAAY,cAAAA,IAAG,WAAW,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YACvE,KAAK;AAAc,cAAAA,IAAG,aAAa,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,YAC3E,KAAK;AAAa,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,QAAQ,MAAM;AAAG;AAAA,YAC1E;AAAS,cAAAA,IAAG,YAAY,UAAU,OAAO,OAAO,OAAO,MAAM;AAAG;AAAA,UAClE;AACA,oBAAU,KAAKA,GAAE;AAAA,QACnB;AACA;AAAA,MACF;AAEA,YAAM,SAAiC,YAAY,cAAc,MAAM,eAAe,IAAI,IAAI,IAAI,kBAAkB,GAAgB;AACpI,YAAM,cAAc,YAChB,MAAM,wBAAwB,KAAkB,UAAU,qBAAqB,GAAG,eAAe,IACjG;AAEJ,UAAI,KAAK,MAAM,GAAG,QAAQ,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,SAAS,CAAC;AACtG,UAAI,CAAC,IAAI;AACP,aAAK,GAAG,OAAO,kBAAkB,EAAE,UAAU,UAAU,gBAAgB,UAAU,UAAU,WAAW,oBAAI,KAAK,EAAE,CAAC;AAClH,kBAAU,KAAK,EAAE;AAAA,MACnB;AACA,wBAAkB,EAAE;AACpB,cAAQ,QAAQ;AAAA,QACd,KAAK;AACH,aAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,QACF,KAAK;AACH,aAAG,iBAAkB,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC/F;AAAA,QACF,KAAK;AACH,aAAG,WAAY,eAA6B,OAAO,OAAO,OAAO,WAAwB;AACzF;AAAA,QACF,KAAK;AACH,aAAG,aAAc,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC3F;AAAA,QACF,KAAK;AACH,aAAG,YAAa,eAA6B,OAAO,OAAO,QAAQ,WAAwB;AAC3F;AAAA,QACF;AACE,aAAG,YAAa,eAA6B,OAAO,OAAO,OAAO,WAAwB;AAC1F;AAAA,MACJ;AAAA,IACF;AAEA,QAAI,UAAU,OAAQ,IAAG,QAAQ,SAAS;AAC1C,UAAM,GAAG,MAAM;AACb,QAAI,0BAA2B,OAAM,KAAK,OAAQ;AAAA,EACpD,SAAS,KAAK;AACZ,QAAI,2BAA2B;AAC7B,UAAI;AAAE,cAAM,KAAK,SAAU;AAAA,MAAE,QAAQ;AAAA,MAA2D;AAAA,IAClG;AACA,UAAM;AAAA,EACR;AAGA,MAAI;AACF,QAAI,OAAO,KAAK,cAAc,YAAY;AACxC,YAAM,KAAK,UAAU,EAAE,UAAU,UAAU,gBAAgB,SAAS,CAAC;AAAA,IACvE;AAAA,EACF,QAAQ;AAAA,EAER;AACF;",
   "names": ["cf"]
 }

package/dist/modules/sales/api/quotes/accept/route.js

@@ -15,6 +15,7 @@ import { SalesOrder, SalesQuote } from "../../../data/entities.js";
 import { quoteAcceptSchema } from "../../../data/validators.js";
 import { sendEmail } from "@open-mercato/shared/lib/email/send";
 import { resolveStatusEntryIdByValue } from "../../../lib/statusHelpers.js";
+import { resolveEffectiveTenantId } from "../../../lib/publicQuoteTenantScope.js";
 import { QuoteAcceptedAdminEmail } from "../../../emails/QuoteAcceptedAdminEmail.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("sales");
@@ -53,7 +54,11 @@ async function POST(req) {
     const container = await createRequestContainer();
     const em = container.resolve("em").fork();
     const hashedToken = hashAuthToken(token);
-    const tenantScope = auth?.tenantId ? { tenantId: auth.tenantId } : void 0;
+    const effectiveTenantId = resolveEffectiveTenantId(auth);
+    if (auth && effectiveTenantId === null && auth.isApiKey !== true) {
+      throw new CrudHttpError(404, { error: translate("sales.quotes.accept.notFound", "Quote not found.") });
+    }
+    const tenantScope = effectiveTenantId ? { tenantId: effectiveTenantId } : void 0;
     const commandBus = container.resolve("commandBus");
     const { quote, orderId } = await em.transactional(async (trx) => {
       const findQuoteByToken = (acceptanceToken) => findOneWithDecryption(
@@ -61,7 +66,7 @@ async function POST(req) {
         SalesQuote,
         {
           acceptanceToken,
-          ...auth?.tenantId ? { tenantId: auth.tenantId } : {},
+          ...effectiveTenantId ? { tenantId: effectiveTenantId } : {},
           deletedAt: null
         },
         { lockMode: LockMode.PESSIMISTIC_WRITE },

package/dist/modules/sales/api/quotes/accept/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/accept/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { validateSameOriginMutationRequest } from './originGuard'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { SalesOrder, SalesQuote } from '../../../data/entities'\nimport { quoteAcceptSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteAcceptedAdminEmail } from '../../../emails/QuoteAcceptedAdminEmail'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\ntype ConvertToOrderResult = {\n  result?: { orderId?: string } | null\n  orderId?: string\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst quoteAcceptRateLimitConfig = readEndpointRateLimitConfig('SALES_QUOTES_ACCEPT', {\n  points: 10,\n  duration: 60,\n  blockDuration: 300,\n  keyPrefix: 'sales_quote_accept',\n})\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const sameOriginViolation = validateSameOriginMutationRequest(req)\n    if (sameOriginViolation) {\n      return NextResponse.json(\n        { error: translate('sales.quotes.accept.forbidden', 'Cross-site quote acceptance is not allowed.') },\n        { status: 403 },\n      )\n    }\n\n    const rateLimiterService = getCachedRateLimiterService()\n    const clientIp = rateLimiterService ? getClientIp(req, rateLimiterService.trustProxyDepth) : null\n    if (rateLimiterService) {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        quoteAcceptRateLimitConfig,\n        clientIp ?? RATE_LIMIT_FALLBACK_KEY,\n        translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n\n    const { token } = quoteAcceptSchema.parse(await req.json().catch(() => ({})))\n    const auth = await getAuthFromRequest(req)\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const hashedToken = hashAuthToken(token)\n    const tenantScope = auth?.tenantId ? { tenantId: auth.tenantId } : undefined\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n\n    // Lock the quote, flip it to confirmed, and convert it to an order inside a\n    // single transaction. The conversion command reuses this transaction (and its\n    // PESSIMISTIC_WRITE lock) via ctx.transactionalEm, so the status flip and the\n    // order creation are atomic: if conversion fails the whole transaction rolls\n    // back, leaving the quote in its prior 'sent' state with no partial order and\n    // no need for an out-of-band compensating write.\n    const { quote, orderId } = await em.transactional(async (trx) => {\n      const findQuoteByToken = (acceptanceToken: string) =>\n        findOneWithDecryption(\n          trx,\n          SalesQuote,\n          {\n            acceptanceToken,\n            ...(auth?.tenantId ? { tenantId: auth.tenantId } : {}),\n            deletedAt: null,\n          },\n          { lockMode: LockMode.PESSIMISTIC_WRITE },\n          tenantScope,\n        )\n      const quote = await findQuoteByToken(hashedToken)\n      if (!quote) {\n        throw notFound(translate('sales.quotes.accept.notFound', 'Quote not found.'))\n      }\n\n      const now = new Date()\n      if (quote.validUntil && quote.validUntil.getTime() < now.getTime()) {\n        throw new CrudHttpError(400, { error: translate('sales.quotes.accept.expired', 'This quote has expired.') })\n      }\n\n      if ((quote.status ?? null) !== 'sent') {\n        throw new CrudHttpError(400, {\n          error: translate('sales.quotes.accept.invalidStatus', 'This quote cannot be accepted in its current status.'),\n        })\n      }\n\n      quote.status = 'confirmed'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(trx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'confirmed',\n      })\n      quote.updatedAt = now\n      trx.persist(quote)\n      await trx.flush()\n\n      const ctx: CommandRuntimeContext = {\n        container,\n        auth: null,\n        organizationScope: null,\n        selectedOrganizationId: quote.organizationId,\n        organizationIds: [quote.organizationId],\n        request: req,\n        transactionalEm: trx,\n      }\n\n      const result = (await commandBus.execute('sales.quotes.convert_to_order', { input: { quoteId: quote.id }, ctx })) as ConvertToOrderResult | null\n      const orderId = result?.result?.orderId ?? result?.orderId ?? quote.id\n\n      return { quote, orderId }\n    })\n\n    const order = await findOneWithDecryption(em, SalesOrder, { id: orderId, deletedAt: null }, {}, tenantScope)\n    const orderNumber = order?.orderNumber ?? orderId\n\n    // Admin notification should not block acceptance.\n    const adminEmail = process.env.ADMIN_EMAIL || ''\n    if (adminEmail) {\n      try {\n        const appUrl = process.env.APP_URL || ''\n        const orderUrl = appUrl ? `${appUrl.replace(/\\/$/, '')}/backend/sales/orders/${orderId}` : `/backend/sales/orders/${orderId}`\n\n        const copy = {\n          preview: translate('sales.quotes.accept.adminEmail.preview', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          heading: translate('sales.quotes.accept.adminEmail.heading', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          body: translate('sales.quotes.accept.adminEmail.body', 'The customer accepted quote {quoteNumber}. An order has been created: {orderNumber}.', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          cta: translate('sales.quotes.accept.adminEmail.cta', 'View order'),\n          footer: translate('sales.quotes.accept.adminEmail.footer', 'Open Mercato'),\n        }\n\n        await sendEmail({\n          to: adminEmail,\n          subject: translate('sales.quotes.accept.adminSubject', 'Quote {quoteNumber} accepted \u2192 Order {orderNumber}', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          react: QuoteAcceptedAdminEmail({ orderUrl, copy }),\n        })\n      } catch (err) {\n        logger.error('sales.quotes.accept.adminEmail failed', { err })\n      }\n    }\n\n    return NextResponse.json({ orderId, orderNumber })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.accept failed', { err })\n    return NextResponse.json({ error: translate('sales.quotes.accept.failed', 'Failed to accept quote.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Accept a quote (public)',\n  methods: {\n    POST: {\n      summary: 'Accept quote and convert to order',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteAcceptSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Quote accepted and order created',\n          schema: z.object({ orderId: z.string().uuid(), orderNumber: z.string() }),\n        },\n        { status: 400, description: 'Invalid or expired quote', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Cross-site request rejected', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Quote not found', schema: z.object({ error: z.string() }) },\n        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,gBAAgB;AAGzD,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,gBAAgB,aAAa,yBAAyB,4BAA4B;AAC3F,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,YAAY,kBAAkB;AACvC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAO5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,6BAA6B,4BAA4B,uBAAuB;AAAA,EACpF,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AACb,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,sBAAsB,kCAAkC,GAAG;AACjE,QAAI,qBAAqB;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,6CAA6C,EAAE;AAAA,QACnG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,qBAAqB,4BAA4B;AACvD,UAAM,WAAW,qBAAqB,YAAY,KAAK,mBAAmB,eAAe,IAAI;AAC7F,QAAI,oBAAoB;AACtB,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,UAAU,wBAAwB,4CAA4C;AAAA,MAChF;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAEA,UAAM,EAAE,MAAM,IAAI,kBAAkB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC5E,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,cAAc,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI;AAEnE,UAAM,aAAa,UAAU,QAAQ,YAAY;AAQjD,UAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AAC/D,YAAM,mBAAmB,CAAC,oBACxB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,GAAI,MAAM,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,UACpD,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACF,YAAMA,SAAQ,MAAM,iBAAiB,WAAW;AAChD,UAAI,CAACA,QAAO;AACV,cAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,MAC9E;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAIA,OAAM,cAAcA,OAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAClE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,+BAA+B,yBAAyB,EAAE,CAAC;AAAA,MAC7G;AAEA,WAAKA,OAAM,UAAU,UAAU,QAAQ;AACrC,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,qCAAqC,sDAAsD;AAAA,QAC9G,CAAC;AAAA,MACH;AAEA,MAAAA,OAAM,SAAS;AACf,MAAAA,OAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAAA,QAC3D,UAAUA,OAAM;AAAA,QAChB,gBAAgBA,OAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,MAAAA,OAAM,YAAY;AAClB,UAAI,QAAQA,MAAK;AACjB,YAAM,IAAI,MAAM;AAEhB,YAAM,MAA6B;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,QACN,mBAAmB;AAAA,QACnB,wBAAwBA,OAAM;AAAA,QAC9B,iBAAiB,CAACA,OAAM,cAAc;AAAA,QACtC,SAAS;AAAA,QACT,iBAAiB;AAAA,MACnB;AAEA,YAAM,SAAU,MAAM,WAAW,QAAQ,iCAAiC,EAAE,OAAO,EAAE,SAASA,OAAM,GAAG,GAAG,IAAI,CAAC;AAC/G,YAAMC,WAAU,QAAQ,QAAQ,WAAW,QAAQ,WAAWD,OAAM;AAEpE,aAAO,EAAE,OAAAA,QAAO,SAAAC,SAAQ;AAAA,IAC1B,CAAC;AAED,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AAC3G,UAAM,cAAc,OAAO,eAAe;AAG1C,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,QAAI,YAAY;AACd,UAAI;AACF,cAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,cAAM,WAAW,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,yBAAyB,OAAO,KAAK,yBAAyB,OAAO;AAE3H,cAAM,OAAO;AAAA,UACX,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,MAAM,UAAU,uCAAuC,wFAAwF;AAAA,YAC7I,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,KAAK,UAAU,sCAAsC,YAAY;AAAA,UACjE,QAAQ,UAAU,yCAAyC,cAAc;AAAA,QAC3E;AAEA,cAAM,UAAU;AAAA,UACd,IAAI;AAAA,UACJ,SAAS,UAAU,oCAAoC,2DAAsD;AAAA,YAC3G,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,OAAO,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,QACnD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,YAAY,CAAC;AAAA,EACnD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AAAA,QAC1E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { validateSameOriginMutationRequest } from './originGuard'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { SalesOrder, SalesQuote } from '../../../data/entities'\nimport { quoteAcceptSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { resolveEffectiveTenantId } from '../../../lib/publicQuoteTenantScope'\nimport { QuoteAcceptedAdminEmail } from '../../../emails/QuoteAcceptedAdminEmail'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\ntype ConvertToOrderResult = {\n  result?: { orderId?: string } | null\n  orderId?: string\n}\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst quoteAcceptRateLimitConfig = readEndpointRateLimitConfig('SALES_QUOTES_ACCEPT', {\n  points: 10,\n  duration: 60,\n  blockDuration: 300,\n  keyPrefix: 'sales_quote_accept',\n})\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const sameOriginViolation = validateSameOriginMutationRequest(req)\n    if (sameOriginViolation) {\n      return NextResponse.json(\n        { error: translate('sales.quotes.accept.forbidden', 'Cross-site quote acceptance is not allowed.') },\n        { status: 403 },\n      )\n    }\n\n    const rateLimiterService = getCachedRateLimiterService()\n    const clientIp = rateLimiterService ? getClientIp(req, rateLimiterService.trustProxyDepth) : null\n    if (rateLimiterService) {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        quoteAcceptRateLimitConfig,\n        clientIp ?? RATE_LIMIT_FALLBACK_KEY,\n        translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n\n    const { token } = quoteAcceptSchema.parse(await req.json().catch(() => ({})))\n    const auth = await getAuthFromRequest(req)\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const hashedToken = hashAuthToken(token)\n    const effectiveTenantId = resolveEffectiveTenantId(auth)\n    // A session whose tenant cannot be resolved must not fall through to an unscoped lookup.\n    // Anonymous callers (no auth) and tenant-less API keys stay unscoped by design.\n    if (auth && effectiveTenantId === null && auth.isApiKey !== true) {\n      throw new CrudHttpError(404, { error: translate('sales.quotes.accept.notFound', 'Quote not found.') })\n    }\n    const tenantScope = effectiveTenantId ? { tenantId: effectiveTenantId } : undefined\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n\n    // Lock the quote, flip it to confirmed, and convert it to an order inside a\n    // single transaction. The conversion command reuses this transaction (and its\n    // PESSIMISTIC_WRITE lock) via ctx.transactionalEm, so the status flip and the\n    // order creation are atomic: if conversion fails the whole transaction rolls\n    // back, leaving the quote in its prior 'sent' state with no partial order and\n    // no need for an out-of-band compensating write.\n    const { quote, orderId } = await em.transactional(async (trx) => {\n      const findQuoteByToken = (acceptanceToken: string) =>\n        findOneWithDecryption(\n          trx,\n          SalesQuote,\n          {\n            acceptanceToken,\n            ...(effectiveTenantId ? { tenantId: effectiveTenantId } : {}),\n            deletedAt: null,\n          },\n          { lockMode: LockMode.PESSIMISTIC_WRITE },\n          tenantScope,\n        )\n      const quote = await findQuoteByToken(hashedToken)\n      if (!quote) {\n        throw notFound(translate('sales.quotes.accept.notFound', 'Quote not found.'))\n      }\n\n      const now = new Date()\n      if (quote.validUntil && quote.validUntil.getTime() < now.getTime()) {\n        throw new CrudHttpError(400, { error: translate('sales.quotes.accept.expired', 'This quote has expired.') })\n      }\n\n      if ((quote.status ?? null) !== 'sent') {\n        throw new CrudHttpError(400, {\n          error: translate('sales.quotes.accept.invalidStatus', 'This quote cannot be accepted in its current status.'),\n        })\n      }\n\n      quote.status = 'confirmed'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(trx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'confirmed',\n      })\n      quote.updatedAt = now\n      trx.persist(quote)\n      await trx.flush()\n\n      const ctx: CommandRuntimeContext = {\n        container,\n        auth: null,\n        organizationScope: null,\n        selectedOrganizationId: quote.organizationId,\n        organizationIds: [quote.organizationId],\n        request: req,\n        transactionalEm: trx,\n      }\n\n      const result = (await commandBus.execute('sales.quotes.convert_to_order', { input: { quoteId: quote.id }, ctx })) as ConvertToOrderResult | null\n      const orderId = result?.result?.orderId ?? result?.orderId ?? quote.id\n\n      return { quote, orderId }\n    })\n\n    const order = await findOneWithDecryption(em, SalesOrder, { id: orderId, deletedAt: null }, {}, tenantScope)\n    const orderNumber = order?.orderNumber ?? orderId\n\n    // Admin notification should not block acceptance.\n    const adminEmail = process.env.ADMIN_EMAIL || ''\n    if (adminEmail) {\n      try {\n        const appUrl = process.env.APP_URL || ''\n        const orderUrl = appUrl ? `${appUrl.replace(/\\/$/, '')}/backend/sales/orders/${orderId}` : `/backend/sales/orders/${orderId}`\n\n        const copy = {\n          preview: translate('sales.quotes.accept.adminEmail.preview', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          heading: translate('sales.quotes.accept.adminEmail.heading', 'Quote {quoteNumber} accepted', { quoteNumber: quote.quoteNumber }),\n          body: translate('sales.quotes.accept.adminEmail.body', 'The customer accepted quote {quoteNumber}. An order has been created: {orderNumber}.', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          cta: translate('sales.quotes.accept.adminEmail.cta', 'View order'),\n          footer: translate('sales.quotes.accept.adminEmail.footer', 'Open Mercato'),\n        }\n\n        await sendEmail({\n          to: adminEmail,\n          subject: translate('sales.quotes.accept.adminSubject', 'Quote {quoteNumber} accepted \u2192 Order {orderNumber}', {\n            quoteNumber: quote.quoteNumber,\n            orderNumber,\n          }),\n          react: QuoteAcceptedAdminEmail({ orderUrl, copy }),\n        })\n      } catch (err) {\n        logger.error('sales.quotes.accept.adminEmail failed', { err })\n      }\n    }\n\n    return NextResponse.json({ orderId, orderNumber })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.accept failed', { err })\n    return NextResponse.json({ error: translate('sales.quotes.accept.failed', 'Failed to accept quote.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Accept a quote (public)',\n  methods: {\n    POST: {\n      summary: 'Accept quote and convert to order',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteAcceptSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Quote accepted and order created',\n          schema: z.object({ orderId: z.string().uuid(), orderNumber: z.string() }),\n        },\n        { status: 400, description: 'Invalid or expired quote', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Cross-site request rejected', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Quote not found', schema: z.object({ error: z.string() }) },\n        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AAEvC,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,gBAAgB;AAGzD,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,gBAAgB,aAAa,yBAAyB,4BAA4B;AAC3F,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,YAAY,kBAAkB;AACvC,SAAS,yBAAyB;AAClC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,gCAAgC;AACzC,SAAS,+BAA+B;AACxC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAO5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,6BAA6B,4BAA4B,uBAAuB;AAAA,EACpF,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AACb,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,sBAAsB,kCAAkC,GAAG;AACjE,QAAI,qBAAqB;AACvB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,6CAA6C,EAAE;AAAA,QACnG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,qBAAqB,4BAA4B;AACvD,UAAM,WAAW,qBAAqB,YAAY,KAAK,mBAAmB,eAAe,IAAI;AAC7F,QAAI,oBAAoB;AACtB,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,UAAU,wBAAwB,4CAA4C;AAAA,MAChF;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAEA,UAAM,EAAE,MAAM,IAAI,kBAAkB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC5E,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,oBAAoB,yBAAyB,IAAI;AAGvD,QAAI,QAAQ,sBAAsB,QAAQ,KAAK,aAAa,MAAM;AAChE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gCAAgC,kBAAkB,EAAE,CAAC;AAAA,IACvG;AACA,UAAM,cAAc,oBAAoB,EAAE,UAAU,kBAAkB,IAAI;AAE1E,UAAM,aAAa,UAAU,QAAQ,YAAY;AAQjD,UAAM,EAAE,OAAO,QAAQ,IAAI,MAAM,GAAG,cAAc,OAAO,QAAQ;AAC/D,YAAM,mBAAmB,CAAC,oBACxB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA,GAAI,oBAAoB,EAAE,UAAU,kBAAkB,IAAI,CAAC;AAAA,UAC3D,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,QACvC;AAAA,MACF;AACF,YAAMA,SAAQ,MAAM,iBAAiB,WAAW;AAChD,UAAI,CAACA,QAAO;AACV,cAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,MAC9E;AAEA,YAAM,MAAM,oBAAI,KAAK;AACrB,UAAIA,OAAM,cAAcA,OAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ,GAAG;AAClE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,+BAA+B,yBAAyB,EAAE,CAAC;AAAA,MAC7G;AAEA,WAAKA,OAAM,UAAU,UAAU,QAAQ;AACrC,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,OAAO,UAAU,qCAAqC,sDAAsD;AAAA,QAC9G,CAAC;AAAA,MACH;AAEA,MAAAA,OAAM,SAAS;AACf,MAAAA,OAAM,gBAAgB,MAAM,4BAA4B,KAAK;AAAA,QAC3D,UAAUA,OAAM;AAAA,QAChB,gBAAgBA,OAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,MAAAA,OAAM,YAAY;AAClB,UAAI,QAAQA,MAAK;AACjB,YAAM,IAAI,MAAM;AAEhB,YAAM,MAA6B;AAAA,QACjC;AAAA,QACA,MAAM;AAAA,QACN,mBAAmB;AAAA,QACnB,wBAAwBA,OAAM;AAAA,QAC9B,iBAAiB,CAACA,OAAM,cAAc;AAAA,QACtC,SAAS;AAAA,QACT,iBAAiB;AAAA,MACnB;AAEA,YAAM,SAAU,MAAM,WAAW,QAAQ,iCAAiC,EAAE,OAAO,EAAE,SAASA,OAAM,GAAG,GAAG,IAAI,CAAC;AAC/G,YAAMC,WAAU,QAAQ,QAAQ,WAAW,QAAQ,WAAWD,OAAM;AAEpE,aAAO,EAAE,OAAAA,QAAO,SAAAC,SAAQ;AAAA,IAC1B,CAAC;AAED,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AAC3G,UAAM,cAAc,OAAO,eAAe;AAG1C,UAAM,aAAa,QAAQ,IAAI,eAAe;AAC9C,QAAI,YAAY;AACd,UAAI;AACF,cAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,cAAM,WAAW,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,yBAAyB,OAAO,KAAK,yBAAyB,OAAO;AAE3H,cAAM,OAAO;AAAA,UACX,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,SAAS,UAAU,0CAA0C,gCAAgC,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,UAC/H,MAAM,UAAU,uCAAuC,wFAAwF;AAAA,YAC7I,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,KAAK,UAAU,sCAAsC,YAAY;AAAA,UACjE,QAAQ,UAAU,yCAAyC,cAAc;AAAA,QAC3E;AAEA,cAAM,UAAU;AAAA,UACd,IAAI;AAAA,UACJ,SAAS,UAAU,oCAAoC,2DAAsD;AAAA,YAC3G,aAAa,MAAM;AAAA,YACnB;AAAA,UACF,CAAC;AAAA,UACD,OAAO,wBAAwB,EAAE,UAAU,KAAK,CAAC;AAAA,QACnD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAAA,MAC/D;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,YAAY,CAAC;AAAA,EACnD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,8BAA8B,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AAAA,QAC1E;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACnG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["quote", "orderId"]
 }

package/dist/modules/sales/api/quotes/public/[token]/route.js

@@ -12,6 +12,7 @@ import {
 } from "../../../../data/entities.js";
 import { canonicalizeUnitCode } from "@open-mercato/shared/lib/units/unitCodes";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { isForeignTenantActor } from "../../../../lib/publicQuoteTenantScope.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("sales");
 const paramsSchema = z.object({
@@ -35,7 +36,7 @@ async function GET(req, ctx) {
       throw notFound(translate("sales.quotes.public.notFound", "Quote not found."));
     }
     const auth = await getAuthFromRequest(req);
-    if (auth?.tenantId && quote.tenantId !== auth.tenantId) {
+    if (isForeignTenantActor(auth, quote.tenantId)) {
       throw notFound(translate("sales.quotes.public.notFound", "Quote not found."));
     }
     const now = /* @__PURE__ */ new Date();

package/dist/modules/sales/api/quotes/public/[token]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/sales/api/quotes/public/%5Btoken%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from \"next/server\";\nimport { z } from \"zod\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport { resolveTranslations } from \"@open-mercato/shared/lib/i18n/server\";\nimport { isCrudHttpError, notFound } from \"@open-mercato/shared/lib/crud/errors\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { findOneWithDecryption, findWithDecryption } from \"@open-mercato/shared/lib/encryption/find\";\nimport { hashAuthToken } from \"../../../../../auth/lib/tokenHash\";\nimport {\n  SalesQuote,\n  SalesQuoteLine,\n  SalesQuoteAdjustment,\n} from \"../../../../data/entities\";\nimport { canonicalizeUnitCode } from \"@open-mercato/shared/lib/units/unitCodes\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nconst paramsSchema = z.object({\n  token: z.string().uuid(),\n});\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(req: Request, ctx: { params: { token: string } }) {\n  try {\n    const { token } = paramsSchema.parse(ctx.params ?? {});\n    const container = await createRequestContainer();\n    const em = container.resolve(\"em\") as EntityManager;\n    const hashedToken = hashAuthToken(token);\n    const quote = await findOneWithDecryption(em, SalesQuote, {\n      acceptanceToken: hashedToken,\n      deletedAt: null,\n    });\n    const { translate } = await resolveTranslations();\n    if (!quote) {\n      throw notFound(translate(\"sales.quotes.public.notFound\", \"Quote not found.\"));\n    }\n\n    const auth = await getAuthFromRequest(req);\n    if (auth?.tenantId && quote.tenantId !== auth.tenantId) {\n      throw notFound(translate(\"sales.quotes.public.notFound\", \"Quote not found.\"));\n    }\n\n    const now = new Date();\n    const isExpired =\n      !!quote.validUntil && quote.validUntil.getTime() < now.getTime();\n\n    const [lines, adjustments] = await Promise.all([\n      findWithDecryption(\n        em,\n        SalesQuoteLine,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId, deletedAt: null },\n        { orderBy: { lineNumber: \"asc\" } },\n      ),\n      findWithDecryption(\n        em,\n        SalesQuoteAdjustment,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId },\n        { orderBy: { position: \"asc\" } },\n      ),\n    ]);\n\n    return NextResponse.json({\n      quote: {\n        quoteNumber: quote.quoteNumber,\n        currencyCode: quote.currencyCode,\n        validFrom: quote.validFrom?.toISOString() ?? null,\n        validUntil: quote.validUntil?.toISOString() ?? null,\n        status: quote.status ?? null,\n        subtotalNetAmount: quote.subtotalNetAmount,\n        subtotalGrossAmount: quote.subtotalGrossAmount,\n        discountTotalAmount: quote.discountTotalAmount,\n        taxTotalAmount: quote.taxTotalAmount,\n        grandTotalNetAmount: quote.grandTotalNetAmount,\n        grandTotalGrossAmount: quote.grandTotalGrossAmount,\n      },\n      lines: lines.map((line) => ({\n        lineNumber: line.lineNumber ?? null,\n        kind: line.kind,\n        name: line.name ?? null,\n        description: line.description ?? null,\n        quantity: line.quantity,\n        quantityUnit: canonicalizeUnitCode(line.quantityUnit) ?? null,\n        normalizedQuantity: line.normalizedQuantity ?? line.quantity,\n        normalizedUnit:\n          canonicalizeUnitCode(line.normalizedUnit ?? line.quantityUnit) ??\n          null,\n        uomSnapshot: line.uomSnapshot\n          ? {\n              baseUnitCode: line.uomSnapshot.baseUnitCode ?? null,\n              enteredUnitCode: line.uomSnapshot.enteredUnitCode ?? null,\n            }\n          : null,\n        currencyCode: line.currencyCode,\n        unitPriceNet: line.unitPriceNet,\n        unitPriceGross: line.unitPriceGross,\n        discountAmount: line.discountAmount,\n        discountPercent: line.discountPercent,\n        taxRate: line.taxRate,\n        taxAmount: line.taxAmount,\n        totalNetAmount: line.totalNetAmount,\n        totalGrossAmount: line.totalGrossAmount,\n        unitPriceReference: (() => {\n          if (!line.uomSnapshot) return null;\n          const ref = line.uomSnapshot.unitPriceReference;\n          if (!ref) return null;\n          return {\n            enabled: ref.enabled ?? null,\n            referenceUnitCode: ref.referenceUnitCode ?? null,\n            baseQuantity: ref.baseQuantity ?? null,\n            grossPerReference: ref.grossPerReference ?? null,\n            netPerReference: ref.netPerReference ?? null,\n          };\n        })(),\n      })),\n      adjustments: adjustments.map((adj) => ({\n        scope: adj.scope,\n        kind: adj.kind,\n        label: adj.label ?? adj.code ?? null,\n        rate: adj.rate,\n        amountNet: adj.amountNet,\n        amountGross: adj.amountGross,\n        currencyCode: adj.currencyCode ?? null,\n        position: adj.position ?? null,\n        quoteLineId: adj.quoteLine?.id ?? null,\n      })),\n      isExpired,\n    });\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status });\n    }\n    const { translate } = await resolveTranslations();\n    logger.error('sales.quotes.public failed', { err });\n    return NextResponse.json(\n      {\n        error: translate(\"sales.quotes.public.failed\", \"Failed to load quote.\"),\n      },\n      { status: 400 },\n    );\n  }\n}\n\nconst publicQuoteResponseSchema = z.object({\n  quote: z.object({\n    quoteNumber: z.string(),\n    currencyCode: z.string(),\n    validFrom: z.string().nullable(),\n    validUntil: z.string().nullable(),\n    status: z.string().nullable(),\n    subtotalNetAmount: z.string(),\n    subtotalGrossAmount: z.string(),\n    discountTotalAmount: z.string(),\n    taxTotalAmount: z.string(),\n    grandTotalNetAmount: z.string(),\n    grandTotalGrossAmount: z.string(),\n  }),\n  lines: z.array(\n    z.object({\n      lineNumber: z.number().nullable(),\n      kind: z.string(),\n      name: z.string().nullable(),\n      description: z.string().nullable(),\n      quantity: z.string(),\n      quantityUnit: z.string().nullable(),\n      normalizedQuantity: z.string(),\n      normalizedUnit: z.string().nullable(),\n      uomSnapshot: z\n        .object({\n          baseUnitCode: z.string().nullable(),\n          enteredUnitCode: z.string().nullable(),\n        })\n        .nullable()\n        .optional(),\n      currencyCode: z.string(),\n      unitPriceNet: z.string(),\n      unitPriceGross: z.string(),\n      discountAmount: z.string(),\n      discountPercent: z.string(),\n      taxRate: z.string(),\n      taxAmount: z.string(),\n      totalNetAmount: z.string(),\n      totalGrossAmount: z.string(),\n      unitPriceReference: z\n        .object({\n          enabled: z.boolean().nullable().optional(),\n          referenceUnitCode: z.string().nullable().optional(),\n          baseQuantity: z.string().nullable().optional(),\n          grossPerReference: z.string().nullable().optional(),\n          netPerReference: z.string().nullable().optional(),\n        })\n        .nullable()\n        .optional(),\n    }),\n  ),\n  adjustments: z.array(\n    z.object({\n      scope: z.string().nullable(),\n      kind: z.string().nullable(),\n      label: z.string().nullable(),\n      rate: z.string().nullable(),\n      amountNet: z.string().nullable(),\n      amountGross: z.string().nullable(),\n      currencyCode: z.string().nullable(),\n      position: z.number().nullable(),\n      quoteLineId: z.string().uuid().nullable(),\n    }),\n  ),\n  isExpired: z.boolean(),\n});\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: \"Sales\",\n  summary: \"View a quote (public)\",\n  pathParams: z.object({ token: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: \"Get quote details by acceptance token\",\n      responses: [\n        {\n          status: 200,\n          description: \"Quote details\",\n          schema: publicQuoteResponseSchema,\n        },\n        {\n          status: 404,\n          description: \"Quote not found\",\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,iBAAiB,gBAAgB;AAG1C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,KAAK;AACzB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IAAI,KAAc,KAAoC;AAC1E,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,aAAa,MAAM,IAAI,UAAU,CAAC,CAAC;AACrD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY;AAAA,MACxD,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,IAC9E;AAEA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,MAAM,YAAY,MAAM,aAAa,KAAK,UAAU;AACtD,YAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,IAC9E;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YACJ,CAAC,CAAC,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ;AAEjE,UAAM,CAAC,OAAO,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7C;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,QACnG,EAAE,SAAS,EAAE,YAAY,MAAM,EAAE;AAAA,MACnC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,QAClF,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,QAC7C,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,QAC/C,QAAQ,MAAM,UAAU;AAAA,QACxB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,qBAAqB,MAAM;AAAA,QAC3B,gBAAgB,MAAM;AAAA,QACtB,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,MAC/B;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,QAC1B,YAAY,KAAK,cAAc;AAAA,QAC/B,MAAM,KAAK;AAAA,QACX,MAAM,KAAK,QAAQ;AAAA,QACnB,aAAa,KAAK,eAAe;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,cAAc,qBAAqB,KAAK,YAAY,KAAK;AAAA,QACzD,oBAAoB,KAAK,sBAAsB,KAAK;AAAA,QACpD,gBACE,qBAAqB,KAAK,kBAAkB,KAAK,YAAY,KAC7D;AAAA,QACF,aAAa,KAAK,cACd;AAAA,UACE,cAAc,KAAK,YAAY,gBAAgB;AAAA,UAC/C,iBAAiB,KAAK,YAAY,mBAAmB;AAAA,QACvD,IACA;AAAA,QACJ,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,QACnB,gBAAgB,KAAK;AAAA,QACrB,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB,SAAS,KAAK;AAAA,QACd,WAAW,KAAK;AAAA,QAChB,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,KAAK;AAAA,QACvB,qBAAqB,MAAM;AACzB,cAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,gBAAM,MAAM,KAAK,YAAY;AAC7B,cAAI,CAAC,IAAK,QAAO;AACjB,iBAAO;AAAA,YACL,SAAS,IAAI,WAAW;AAAA,YACxB,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,cAAc,IAAI,gBAAgB;AAAA,YAClC,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,iBAAiB,IAAI,mBAAmB;AAAA,UAC1C;AAAA,QACF,GAAG;AAAA,MACL,EAAE;AAAA,MACF,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,QACrC,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,OAAO,IAAI,SAAS,IAAI,QAAQ;AAAA,QAChC,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI,gBAAgB;AAAA,QAClC,UAAU,IAAI,YAAY;AAAA,QAC1B,aAAa,IAAI,WAAW,MAAM;AAAA,MACpC,EAAE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,UAAU,8BAA8B,uBAAuB;AAAA,MACxE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO;AAAA,IACd,aAAa,EAAE,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,mBAAmB,EAAE,OAAO;AAAA,IAC5B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,gBAAgB,EAAE,OAAO;AAAA,IACzB,qBAAqB,EAAE,OAAO;AAAA,IAC9B,uBAAuB,EAAE,OAAO;AAAA,EAClC,CAAC;AAAA,EACD,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,UAAU,EAAE,OAAO;AAAA,MACnB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,oBAAoB,EAAE,OAAO;AAAA,MAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,aAAa,EACV,OAAO;AAAA,QACN,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,MACvC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,MACZ,cAAc,EAAE,OAAO;AAAA,MACvB,cAAc,EAAE,OAAO;AAAA,MACvB,gBAAgB,EAAE,OAAO;AAAA,MACzB,gBAAgB,EAAE,OAAO;AAAA,MACzB,iBAAiB,EAAE,OAAO;AAAA,MAC1B,SAAS,EAAE,OAAO;AAAA,MAClB,WAAW,EAAE,OAAO;AAAA,MACpB,gBAAgB,EAAE,OAAO;AAAA,MACzB,kBAAkB,EAAE,OAAO;AAAA,MAC3B,oBAAoB,EACjB,OAAO;AAAA,QACN,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,QACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAC7C,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAClD,CAAC,EACA,SAAS,EACT,SAAS;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA,EACA,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACjD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from \"next/server\";\nimport { z } from \"zod\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport { resolveTranslations } from \"@open-mercato/shared/lib/i18n/server\";\nimport { isCrudHttpError, notFound } from \"@open-mercato/shared/lib/crud/errors\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { findOneWithDecryption, findWithDecryption } from \"@open-mercato/shared/lib/encryption/find\";\nimport { hashAuthToken } from \"../../../../../auth/lib/tokenHash\";\nimport {\n  SalesQuote,\n  SalesQuoteLine,\n  SalesQuoteAdjustment,\n} from \"../../../../data/entities\";\nimport { canonicalizeUnitCode } from \"@open-mercato/shared/lib/units/unitCodes\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { isForeignTenantActor } from \"../../../../lib/publicQuoteTenantScope\";\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nconst paramsSchema = z.object({\n  token: z.string().uuid(),\n});\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(req: Request, ctx: { params: { token: string } }) {\n  try {\n    const { token } = paramsSchema.parse(ctx.params ?? {});\n    const container = await createRequestContainer();\n    const em = container.resolve(\"em\") as EntityManager;\n    const hashedToken = hashAuthToken(token);\n    const quote = await findOneWithDecryption(em, SalesQuote, {\n      acceptanceToken: hashedToken,\n      deletedAt: null,\n    });\n    const { translate } = await resolveTranslations();\n    if (!quote) {\n      throw notFound(translate(\"sales.quotes.public.notFound\", \"Quote not found.\"));\n    }\n\n    const auth = await getAuthFromRequest(req);\n    if (isForeignTenantActor(auth, quote.tenantId)) {\n      throw notFound(translate(\"sales.quotes.public.notFound\", \"Quote not found.\"));\n    }\n\n    const now = new Date();\n    const isExpired =\n      !!quote.validUntil && quote.validUntil.getTime() < now.getTime();\n\n    const [lines, adjustments] = await Promise.all([\n      findWithDecryption(\n        em,\n        SalesQuoteLine,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId, deletedAt: null },\n        { orderBy: { lineNumber: \"asc\" } },\n      ),\n      findWithDecryption(\n        em,\n        SalesQuoteAdjustment,\n        { quote: quote.id, organizationId: quote.organizationId, tenantId: quote.tenantId },\n        { orderBy: { position: \"asc\" } },\n      ),\n    ]);\n\n    return NextResponse.json({\n      quote: {\n        quoteNumber: quote.quoteNumber,\n        currencyCode: quote.currencyCode,\n        validFrom: quote.validFrom?.toISOString() ?? null,\n        validUntil: quote.validUntil?.toISOString() ?? null,\n        status: quote.status ?? null,\n        subtotalNetAmount: quote.subtotalNetAmount,\n        subtotalGrossAmount: quote.subtotalGrossAmount,\n        discountTotalAmount: quote.discountTotalAmount,\n        taxTotalAmount: quote.taxTotalAmount,\n        grandTotalNetAmount: quote.grandTotalNetAmount,\n        grandTotalGrossAmount: quote.grandTotalGrossAmount,\n      },\n      lines: lines.map((line) => ({\n        lineNumber: line.lineNumber ?? null,\n        kind: line.kind,\n        name: line.name ?? null,\n        description: line.description ?? null,\n        quantity: line.quantity,\n        quantityUnit: canonicalizeUnitCode(line.quantityUnit) ?? null,\n        normalizedQuantity: line.normalizedQuantity ?? line.quantity,\n        normalizedUnit:\n          canonicalizeUnitCode(line.normalizedUnit ?? line.quantityUnit) ??\n          null,\n        uomSnapshot: line.uomSnapshot\n          ? {\n              baseUnitCode: line.uomSnapshot.baseUnitCode ?? null,\n              enteredUnitCode: line.uomSnapshot.enteredUnitCode ?? null,\n            }\n          : null,\n        currencyCode: line.currencyCode,\n        unitPriceNet: line.unitPriceNet,\n        unitPriceGross: line.unitPriceGross,\n        discountAmount: line.discountAmount,\n        discountPercent: line.discountPercent,\n        taxRate: line.taxRate,\n        taxAmount: line.taxAmount,\n        totalNetAmount: line.totalNetAmount,\n        totalGrossAmount: line.totalGrossAmount,\n        unitPriceReference: (() => {\n          if (!line.uomSnapshot) return null;\n          const ref = line.uomSnapshot.unitPriceReference;\n          if (!ref) return null;\n          return {\n            enabled: ref.enabled ?? null,\n            referenceUnitCode: ref.referenceUnitCode ?? null,\n            baseQuantity: ref.baseQuantity ?? null,\n            grossPerReference: ref.grossPerReference ?? null,\n            netPerReference: ref.netPerReference ?? null,\n          };\n        })(),\n      })),\n      adjustments: adjustments.map((adj) => ({\n        scope: adj.scope,\n        kind: adj.kind,\n        label: adj.label ?? adj.code ?? null,\n        rate: adj.rate,\n        amountNet: adj.amountNet,\n        amountGross: adj.amountGross,\n        currencyCode: adj.currencyCode ?? null,\n        position: adj.position ?? null,\n        quoteLineId: adj.quoteLine?.id ?? null,\n      })),\n      isExpired,\n    });\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status });\n    }\n    const { translate } = await resolveTranslations();\n    logger.error('sales.quotes.public failed', { err });\n    return NextResponse.json(\n      {\n        error: translate(\"sales.quotes.public.failed\", \"Failed to load quote.\"),\n      },\n      { status: 400 },\n    );\n  }\n}\n\nconst publicQuoteResponseSchema = z.object({\n  quote: z.object({\n    quoteNumber: z.string(),\n    currencyCode: z.string(),\n    validFrom: z.string().nullable(),\n    validUntil: z.string().nullable(),\n    status: z.string().nullable(),\n    subtotalNetAmount: z.string(),\n    subtotalGrossAmount: z.string(),\n    discountTotalAmount: z.string(),\n    taxTotalAmount: z.string(),\n    grandTotalNetAmount: z.string(),\n    grandTotalGrossAmount: z.string(),\n  }),\n  lines: z.array(\n    z.object({\n      lineNumber: z.number().nullable(),\n      kind: z.string(),\n      name: z.string().nullable(),\n      description: z.string().nullable(),\n      quantity: z.string(),\n      quantityUnit: z.string().nullable(),\n      normalizedQuantity: z.string(),\n      normalizedUnit: z.string().nullable(),\n      uomSnapshot: z\n        .object({\n          baseUnitCode: z.string().nullable(),\n          enteredUnitCode: z.string().nullable(),\n        })\n        .nullable()\n        .optional(),\n      currencyCode: z.string(),\n      unitPriceNet: z.string(),\n      unitPriceGross: z.string(),\n      discountAmount: z.string(),\n      discountPercent: z.string(),\n      taxRate: z.string(),\n      taxAmount: z.string(),\n      totalNetAmount: z.string(),\n      totalGrossAmount: z.string(),\n      unitPriceReference: z\n        .object({\n          enabled: z.boolean().nullable().optional(),\n          referenceUnitCode: z.string().nullable().optional(),\n          baseQuantity: z.string().nullable().optional(),\n          grossPerReference: z.string().nullable().optional(),\n          netPerReference: z.string().nullable().optional(),\n        })\n        .nullable()\n        .optional(),\n    }),\n  ),\n  adjustments: z.array(\n    z.object({\n      scope: z.string().nullable(),\n      kind: z.string().nullable(),\n      label: z.string().nullable(),\n      rate: z.string().nullable(),\n      amountNet: z.string().nullable(),\n      amountGross: z.string().nullable(),\n      currencyCode: z.string().nullable(),\n      position: z.number().nullable(),\n      quoteLineId: z.string().uuid().nullable(),\n    }),\n  ),\n  isExpired: z.boolean(),\n});\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: \"Sales\",\n  summary: \"View a quote (public)\",\n  pathParams: z.object({ token: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: \"Get quote details by acceptance token\",\n      responses: [\n        {\n          status: 200,\n          description: \"Quote details\",\n          schema: publicQuoteResponseSchema,\n        },\n        {\n          status: 404,\n          description: \"Quote not found\",\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,iBAAiB,gBAAgB;AAG1C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,KAAK;AACzB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IAAI,KAAc,KAAoC;AAC1E,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,aAAa,MAAM,IAAI,UAAU,CAAC,CAAC;AACrD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY;AAAA,MACxD,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb,CAAC;AACD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,IAC9E;AAEA,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,qBAAqB,MAAM,MAAM,QAAQ,GAAG;AAC9C,YAAM,SAAS,UAAU,gCAAgC,kBAAkB,CAAC;AAAA,IAC9E;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YACJ,CAAC,CAAC,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,IAAI,QAAQ;AAEjE,UAAM,CAAC,OAAO,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7C;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,QACnG,EAAE,SAAS,EAAE,YAAY,MAAM,EAAE;AAAA,MACnC;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,EAAE,OAAO,MAAM,IAAI,gBAAgB,MAAM,gBAAgB,UAAU,MAAM,SAAS;AAAA,QAClF,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,QACL,aAAa,MAAM;AAAA,QACnB,cAAc,MAAM;AAAA,QACpB,WAAW,MAAM,WAAW,YAAY,KAAK;AAAA,QAC7C,YAAY,MAAM,YAAY,YAAY,KAAK;AAAA,QAC/C,QAAQ,MAAM,UAAU;AAAA,QACxB,mBAAmB,MAAM;AAAA,QACzB,qBAAqB,MAAM;AAAA,QAC3B,qBAAqB,MAAM;AAAA,QAC3B,gBAAgB,MAAM;AAAA,QACtB,qBAAqB,MAAM;AAAA,QAC3B,uBAAuB,MAAM;AAAA,MAC/B;AAAA,MACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,QAC1B,YAAY,KAAK,cAAc;AAAA,QAC/B,MAAM,KAAK;AAAA,QACX,MAAM,KAAK,QAAQ;AAAA,QACnB,aAAa,KAAK,eAAe;AAAA,QACjC,UAAU,KAAK;AAAA,QACf,cAAc,qBAAqB,KAAK,YAAY,KAAK;AAAA,QACzD,oBAAoB,KAAK,sBAAsB,KAAK;AAAA,QACpD,gBACE,qBAAqB,KAAK,kBAAkB,KAAK,YAAY,KAC7D;AAAA,QACF,aAAa,KAAK,cACd;AAAA,UACE,cAAc,KAAK,YAAY,gBAAgB;AAAA,UAC/C,iBAAiB,KAAK,YAAY,mBAAmB;AAAA,QACvD,IACA;AAAA,QACJ,cAAc,KAAK;AAAA,QACnB,cAAc,KAAK;AAAA,QACnB,gBAAgB,KAAK;AAAA,QACrB,gBAAgB,KAAK;AAAA,QACrB,iBAAiB,KAAK;AAAA,QACtB,SAAS,KAAK;AAAA,QACd,WAAW,KAAK;AAAA,QAChB,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,KAAK;AAAA,QACvB,qBAAqB,MAAM;AACzB,cAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,gBAAM,MAAM,KAAK,YAAY;AAC7B,cAAI,CAAC,IAAK,QAAO;AACjB,iBAAO;AAAA,YACL,SAAS,IAAI,WAAW;AAAA,YACxB,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,cAAc,IAAI,gBAAgB;AAAA,YAClC,mBAAmB,IAAI,qBAAqB;AAAA,YAC5C,iBAAiB,IAAI,mBAAmB;AAAA,UAC1C;AAAA,QACF,GAAG;AAAA,MACL,EAAE;AAAA,MACF,aAAa,YAAY,IAAI,CAAC,SAAS;AAAA,QACrC,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,OAAO,IAAI,SAAS,IAAI,QAAQ;AAAA,QAChC,MAAM,IAAI;AAAA,QACV,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,cAAc,IAAI,gBAAgB;AAAA,QAClC,UAAU,IAAI,YAAY;AAAA,QAC1B,aAAa,IAAI,WAAW,MAAM;AAAA,MACpC,EAAE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,UAAU,8BAA8B,uBAAuB;AAAA,MACxE;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO;AAAA,IACd,aAAa,EAAE,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO;AAAA,IACvB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,mBAAmB,EAAE,OAAO;AAAA,IAC5B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,qBAAqB,EAAE,OAAO;AAAA,IAC9B,gBAAgB,EAAE,OAAO;AAAA,IACzB,qBAAqB,EAAE,OAAO;AAAA,IAC9B,uBAAuB,EAAE,OAAO;AAAA,EAClC,CAAC;AAAA,EACD,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,MAChC,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,UAAU,EAAE,OAAO;AAAA,MACnB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,oBAAoB,EAAE,OAAO;AAAA,MAC7B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,MACpC,aAAa,EACV,OAAO;AAAA,QACN,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,QAClC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,MACvC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,MACZ,cAAc,EAAE,OAAO;AAAA,MACvB,cAAc,EAAE,OAAO;AAAA,MACvB,gBAAgB,EAAE,OAAO;AAAA,MACzB,gBAAgB,EAAE,OAAO;AAAA,MACzB,iBAAiB,EAAE,OAAO;AAAA,MAC1B,SAAS,EAAE,OAAO;AAAA,MAClB,WAAW,EAAE,OAAO;AAAA,MACpB,gBAAgB,EAAE,OAAO;AAAA,MACzB,kBAAkB,EAAE,OAAO;AAAA,MAC3B,oBAAoB,EACjB,OAAO;AAAA,QACN,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,QACzC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAC7C,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,QAClD,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAClD,CAAC,EACA,SAAS,EACT,SAAS;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE;AAAA,IACb,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,MACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,MAClC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA,EACA,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACjD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/lib/publicQuoteTenantScope.js

@@ -0,0 +1,24 @@
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function normalizeTenantValue(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!UUID_RE.test(trimmed)) return null;
+  return trimmed.toLowerCase();
+}
+function resolveEffectiveTenantId(auth) {
+  if (!auth) return null;
+  const selectedTenantId = normalizeTenantValue(auth.tenantId);
+  if (selectedTenantId !== null) return selectedTenantId;
+  return normalizeTenantValue(auth.actorTenantId);
+}
+function isForeignTenantActor(auth, documentTenantId) {
+  if (!auth) return false;
+  const effectiveTenantId = resolveEffectiveTenantId(auth);
+  if (effectiveTenantId === null) return auth.isApiKey !== true;
+  return effectiveTenantId !== normalizeTenantValue(documentTenantId);
+}
+export {
+  isForeignTenantActor,
+  resolveEffectiveTenantId
+};
+//# sourceMappingURL=publicQuoteTenantScope.js.map

package/dist/modules/sales/lib/publicQuoteTenantScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/sales/lib/publicQuoteTenantScope.ts"],
+  "sourcesContent": ["import type { AuthContext } from '@open-mercato/shared/lib/auth/server'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction normalizeTenantValue(value: unknown): string | null {\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  if (!UUID_RE.test(trimmed)) return null\n  return trimmed.toLowerCase()\n}\n\n/**\n * The tenant a signed-in actor's reads and writes are scoped to, or null when none can be\n * resolved (including anonymous requests).\n *\n * `applySuperAdminScope` rewrites `auth.tenantId` from the `om_selected_tenant` cookie and\n * preserves the actor's own tenant under `actorTenantId`. An explicit selection is an intentional\n * scope and wins; an empty cookie (\"all tenants\") sets `auth.tenantId` to null on an otherwise\n * fully authenticated session, so the actor's own tenant is the fallback. `auth.tenantId` alone\n * cannot decide the scope, which is what defeated the public quote guard in #4309.\n *\n * A value that is not a well-formed UUID is treated as unresolvable rather than passed through to\n * a `uuid` column filter, since the cookie is attacker-controllable by the actor themselves.\n */\nexport function resolveEffectiveTenantId(auth: AuthContext): string | null {\n  if (!auth) return null\n  const selectedTenantId = normalizeTenantValue(auth.tenantId)\n  if (selectedTenantId !== null) return selectedTenantId\n  return normalizeTenantValue((auth as { actorTenantId?: unknown }).actorTenantId)\n}\n\n/**\n * True when the request carries a session belonging to a tenant other than the document's.\n *\n * An authenticated session whose tenant cannot be resolved counts as foreign \u2014 treating\n * \"tenant unknown\" as \"allow\" is the #4309 bug. Two cases are deliberately NOT foreign:\n *\n * - Anonymous requests. The public quote link is meant to work without a session, and denying\n *   here would break the endpoint's entire purpose.\n * - API keys with no tenant. `ApiKey.tenantId` is nullable, so a global key legitimately resolves\n *   to no tenant. Denying it would reject a more-privileged caller than the anonymous one that\n *   the same link already serves.\n */\nexport function isForeignTenantActor(auth: AuthContext, documentTenantId: unknown): boolean {\n  if (!auth) return false\n  const effectiveTenantId = resolveEffectiveTenantId(auth)\n  if (effectiveTenantId === null) return auth.isApiKey !== true\n  return effectiveTenantId !== normalizeTenantValue(documentTenantId)\n}\n"],
+  "mappings": "AAEA,MAAM,UAAU;AAEhB,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAG,QAAO;AACnC,SAAO,QAAQ,YAAY;AAC7B;AAeO,SAAS,yBAAyB,MAAkC;AACzE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,mBAAmB,qBAAqB,KAAK,QAAQ;AAC3D,MAAI,qBAAqB,KAAM,QAAO;AACtC,SAAO,qBAAsB,KAAqC,aAAa;AACjF;AAcO,SAAS,qBAAqB,MAAmB,kBAAoC;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,oBAAoB,yBAAyB,IAAI;AACvD,MAAI,sBAAsB,KAAM,QAAO,KAAK,aAAa;AACzD,SAAO,sBAAsB,qBAAqB,gBAAgB;AACpE;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.7-develop.6661.1.0043ed1d03",
+  "version": "0.6.7-develop.6669.1.40b669666b",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6661.1.0043ed1d03",
-    "@open-mercato/shared": "0.6.7-develop.6661.1.0043ed1d03",
-    "@open-mercato/ui": "0.6.7-develop.6661.1.0043ed1d03",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6669.1.40b669666b",
+    "@open-mercato/shared": "0.6.7-develop.6669.1.40b669666b",
+    "@open-mercato/ui": "0.6.7-develop.6669.1.40b669666b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.7-develop.6661.1.0043ed1d03",
-    "@open-mercato/shared": "0.6.7-develop.6661.1.0043ed1d03",
-    "@open-mercato/ui": "0.6.7-develop.6661.1.0043ed1d03",
+    "@open-mercato/ai-assistant": "0.6.7-develop.6669.1.40b669666b",
+    "@open-mercato/shared": "0.6.7-develop.6669.1.40b669666b",
+    "@open-mercato/ui": "0.6.7-develop.6669.1.40b669666b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/customer_accounts/migrations/Migration20260724120000_customer_accounts.ts

@@ -0,0 +1,96 @@
+import { Migration } from '@mikro-orm/migrations';
+
+/**
+ * Builds the one-off repair for `customer_users.customer_entity_id` (#4473).
+ *
+ * `customerEntityId` is the CRM *company* FK and the portal company scope key —
+ * the portal Users page, portal invitations, and the company detail "Portal
+ * users" group all filter on it. Earlier invite flows (#4362) could store a
+ * person entity id, or an entity from another organization, in that column.
+ * The `autoLinkCrm` subscriber normalizes it (#4457), but it only runs on
+ * `customer_accounts.user.created`, which is never re-emitted for a row that
+ * already exists — so users created before that fix keep the bad FK forever.
+ * They stay scoped to the wrong company and every admin edit that resubmits the
+ * pre-filled value fails with "Company not found".
+ *
+ * The repair mirrors the subscriber's normalization exactly: touch only rows
+ * whose FK does NOT resolve to an in-org, non-deleted `company` entity, and for
+ * those either recover the real company from the person's profile (when the FK
+ * points at an in-org person whose company is itself in-org) or clear it.
+ *
+ * `updated_at` is bumped on every repaired row on purpose: it is the optimistic
+ * lock version. Without the bump a client holding the pre-repair version could
+ * resubmit the poisoned value and silently undo the fix instead of getting a
+ * 409 conflict.
+ *
+ * The whole statement is wrapped in a `to_regclass` guard because the `customers`
+ * tables it reads belong to a different module. `dbMigrate` walks enabled modules
+ * in alphabetical order, so `customer_accounts` migrations run BEFORE `customers`
+ * ones — on a fresh database these tables do not exist yet. A database in that
+ * state has no poisoned rows to repair either, so skipping is the correct no-op.
+ * `catalog/Migration20251116191744` already ships the same guarded `do $$` idiom.
+ *
+ * This SQL is hand-written rather than produced by `yarn db:generate`, which the
+ * review checklist otherwise requires. The generator only diffs entities against
+ * the schema snapshot, so it cannot emit a data repair, and there is no schema
+ * change here to diff: no column, index, or constraint is touched, which is why
+ * `.snapshot-open-mercato.json` is deliberately left untouched by this migration.
+ *
+ * @public Exported for testing
+ */
+export function buildRepairPoisonedCustomerEntityLinksSql(): string {
+  return `do $$
+begin
+  if to_regclass('customer_entities') is null or to_regclass('customer_people') is null then
+    return;
+  end if;
+
+  update "customer_users" cu
+     set "customer_entity_id" = (
+           select company."id"
+             from "customer_entities" person
+             join "customer_people" profile
+               on profile."entity_id" = person."id"
+              and profile."tenant_id" = person."tenant_id"
+              and profile."organization_id" = person."organization_id"
+             join "customer_entities" company
+               on company."id" = profile."company_entity_id"
+              and company."tenant_id" = person."tenant_id"
+              and company."organization_id" = person."organization_id"
+              and company."kind" = 'company'
+              and company."deleted_at" is null
+            where person."id" = cu."customer_entity_id"
+              and person."tenant_id" = cu."tenant_id"
+              and person."organization_id" = cu."organization_id"
+              and person."kind" = 'person'
+              and person."deleted_at" is null
+            order by profile."created_at", profile."id"
+            limit 1
+         ),
+         "updated_at" = now()
+   where cu."customer_entity_id" is not null
+     and not exists (
+           select 1
+             from "customer_entities" company
+            where company."id" = cu."customer_entity_id"
+              and company."tenant_id" = cu."tenant_id"
+              and company."organization_id" = cu."organization_id"
+              and company."kind" = 'company'
+              and company."deleted_at" is null
+         );
+end
+$$;`;
+}
+
+export class Migration20260724120000_customer_accounts extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(buildRepairPoisonedCustomerEntityLinksSql());
+  }
+
+  override down(): void | Promise<void> {
+    // Forward-only: the poisoned values are not recorded anywhere, so there is
+    // nothing to restore. Re-poisoning the column would reintroduce the bug.
+  }
+
+}

package/src/modules/directory/api/organizations/route.ts

@@ -52,7 +52,7 @@ type TreeNode = {
 
 const viewSchema = z.object({
   page: z.coerce.number().min(1).default(1),
-  pageSize: z.coerce.number().min(1).max(200).default(50),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
   search: z.string().optional(),
   view: z.enum(['options', 'manage', 'tree']).default('options'),
   ids: z.string().optional(),

package/src/modules/entities/api/definitions.ts

@@ -421,6 +421,8 @@ export async function GET(req: Request) {
         // attachments config passthrough
         maxAttachmentSizeMb: typeof d.configJson?.maxAttachmentSizeMb === 'number' ? d.configJson.maxAttachmentSizeMb : undefined,
         acceptExtensions: Array.isArray(d.configJson?.acceptExtensions) ? d.configJson.acceptExtensions : undefined,
+        // phone config passthrough
+        defaultCountryIso2: typeof d.configJson?.defaultCountryIso2 === 'string' ? d.configJson.defaultCountryIso2 : undefined,
         entityId,
         fieldset: normalizedFieldset ?? effectiveFieldsets[0],
         fieldsets: effectiveFieldsets.length > 0 ? effectiveFieldsets : undefined,

package/src/modules/entities/lib/helpers.ts

@@ -30,6 +30,7 @@ function columnFromKind(kind: string): keyof CustomFieldValue {
     case 'select':
     case 'currency':
     case 'dictionary':
+    case 'phone':
       return 'valueText'
     case 'multiline':
       return 'valueMultiline'

package/src/modules/sales/api/quotes/accept/route.ts

@@ -18,6 +18,7 @@ import { SalesOrder, SalesQuote } from '../../../data/entities'
 import { quoteAcceptSchema } from '../../../data/validators'
 import { sendEmail } from '@open-mercato/shared/lib/email/send'
 import { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'
+import { resolveEffectiveTenantId } from '../../../lib/publicQuoteTenantScope'
 import { QuoteAcceptedAdminEmail } from '../../../emails/QuoteAcceptedAdminEmail'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -68,7 +69,13 @@ export async function POST(req: Request) {
     const em = (container.resolve('em') as EntityManager).fork()
 
     const hashedToken = hashAuthToken(token)
-    const tenantScope = auth?.tenantId ? { tenantId: auth.tenantId } : undefined
+    const effectiveTenantId = resolveEffectiveTenantId(auth)
+    // A session whose tenant cannot be resolved must not fall through to an unscoped lookup.
+    // Anonymous callers (no auth) and tenant-less API keys stay unscoped by design.
+    if (auth && effectiveTenantId === null && auth.isApiKey !== true) {
+      throw new CrudHttpError(404, { error: translate('sales.quotes.accept.notFound', 'Quote not found.') })
+    }
+    const tenantScope = effectiveTenantId ? { tenantId: effectiveTenantId } : undefined
 
     const commandBus = container.resolve('commandBus') as CommandBus
 
@@ -85,7 +92,7 @@ export async function POST(req: Request) {
           SalesQuote,
           {
             acceptanceToken,
-            ...(auth?.tenantId ? { tenantId: auth.tenantId } : {}),
+            ...(effectiveTenantId ? { tenantId: effectiveTenantId } : {}),
             deletedAt: null,
           },
           { lockMode: LockMode.PESSIMISTIC_WRITE },

package/src/modules/sales/api/quotes/public/[token]/route.ts

@@ -14,6 +14,7 @@ import {
 } from "../../../../data/entities";
 import { canonicalizeUnitCode } from "@open-mercato/shared/lib/units/unitCodes";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { isForeignTenantActor } from "../../../../lib/publicQuoteTenantScope";
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('sales')
@@ -42,7 +43,7 @@ export async function GET(req: Request, ctx: { params: { token: string } }) {
     }
 
     const auth = await getAuthFromRequest(req);
-    if (auth?.tenantId && quote.tenantId !== auth.tenantId) {
+    if (isForeignTenantActor(auth, quote.tenantId)) {
       throw notFound(translate("sales.quotes.public.notFound", "Quote not found."));
     }
 

package/src/modules/sales/lib/publicQuoteTenantScope.ts

@@ -0,0 +1,49 @@
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+function normalizeTenantValue(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (!UUID_RE.test(trimmed)) return null
+  return trimmed.toLowerCase()
+}
+
+/**
+ * The tenant a signed-in actor's reads and writes are scoped to, or null when none can be
+ * resolved (including anonymous requests).
+ *
+ * `applySuperAdminScope` rewrites `auth.tenantId` from the `om_selected_tenant` cookie and
+ * preserves the actor's own tenant under `actorTenantId`. An explicit selection is an intentional
+ * scope and wins; an empty cookie ("all tenants") sets `auth.tenantId` to null on an otherwise
+ * fully authenticated session, so the actor's own tenant is the fallback. `auth.tenantId` alone
+ * cannot decide the scope, which is what defeated the public quote guard in #4309.
+ *
+ * A value that is not a well-formed UUID is treated as unresolvable rather than passed through to
+ * a `uuid` column filter, since the cookie is attacker-controllable by the actor themselves.
+ */
+export function resolveEffectiveTenantId(auth: AuthContext): string | null {
+  if (!auth) return null
+  const selectedTenantId = normalizeTenantValue(auth.tenantId)
+  if (selectedTenantId !== null) return selectedTenantId
+  return normalizeTenantValue((auth as { actorTenantId?: unknown }).actorTenantId)
+}
+
+/**
+ * True when the request carries a session belonging to a tenant other than the document's.
+ *
+ * An authenticated session whose tenant cannot be resolved counts as foreign — treating
+ * "tenant unknown" as "allow" is the #4309 bug. Two cases are deliberately NOT foreign:
+ *
+ * - Anonymous requests. The public quote link is meant to work without a session, and denying
+ *   here would break the endpoint's entire purpose.
+ * - API keys with no tenant. `ApiKey.tenantId` is nullable, so a global key legitimately resolves
+ *   to no tenant. Denying it would reject a more-privileged caller than the anonymous one that
+ *   the same link already serves.
+ */
+export function isForeignTenantActor(auth: AuthContext, documentTenantId: unknown): boolean {
+  if (!auth) return false
+  const effectiveTenantId = resolveEffectiveTenantId(auth)
+  if (effectiveTenantId === null) return auth.isApiKey !== true
+  return effectiveTenantId !== normalizeTenantValue(documentTenantId)
+}