@open-mercato/core 0.6.7-develop.6661.1.0043ed1d03 → 0.6.7-develop.6670.1.4efa7961c6

package/dist/modules/wms/api/inventory/helpers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/wms/api/inventory/helpers.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('wms')\n\ntype ResourceDescriptor = {\n  resourceKind: string\n  resourceId: string\n}\n\ntype ExecuteWmsCustomPostRouteOptions<TInput, TResult> = {\n  request: Request\n  routePath: string\n  inputSchema: z.ZodType<TInput>\n  commandId: string\n  describeResource: (input: TInput) => ResourceDescriptor\n  mapSuccess: (result: TResult) => Record<string, unknown>\n}\n\nexport async function executeWmsCustomPostRoute<TInput, TResult>(\n  options: ExecuteWmsCustomPostRouteOptions<TInput, TResult>,\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(options.request)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: options.request,\n    })\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: options.request,\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(options.request, {})\n    const parsed = options.inputSchema.parse(body)\n    const resource = options.describeResource(parsed)\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const execution = await commandBus.execute<TInput, TResult>(options.commandId, {\n      input: parsed,\n      ctx,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const responseBody = options.mapSuccess(execution.result)\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: container.resolve('em'),\n        container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('custom route failed', { routePath: options.routePath, commandId: options.commandId, err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,KAAK;AAgBjC,eAAsB,0BACpB,SACA;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS,QAAQ;AAAA,IACnB;AACA,UAAM,OAAO,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,YAAY,MAAM,IAAI;AAC7C,UAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,YAAY,MAAM,WAAW,QAAyB,QAAQ,WAAW;AAAA,MAC7E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,eAAe,QAAQ,WAAW,UAAU,MAAM;AACxD,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC1B;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,WAAW,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/import/apply/route.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+import { inventoryImportApplySchema } from "../../../../data/validators.js";
+import { executeWmsInventoryImportRoute } from "../helpers.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.import"] }
+};
+async function POST(request) {
+  return executeWmsInventoryImportRoute({
+    request,
+    routePath: "wms/inventory/import/apply",
+    mode: "apply"
+  });
+}
+const successSchema = z.object({
+  ok: z.boolean(),
+  importBatchId: z.string().uuid(),
+  summary: z.object({
+    applied: z.number(),
+    skipped: z.number(),
+    failed: z.number()
+  })
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "WMS",
+  summary: "Apply inventory CSV import",
+  methods: {
+    POST: {
+      summary: "Apply inventory CSV import",
+      description: "Applies validated inventory import rows via wms.inventory.adjust commands (idempotent skip when delta is zero).",
+      requestBody: { contentType: "application/json", schema: inventoryImportApplySchema },
+      responses: [{ status: 200, description: "Import applied", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 409, description: "Partial apply failure", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/inventory/import/apply/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/wms/api/inventory/import/apply/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryImportApplySchema } from '../../../../data/validators'\nimport { executeWmsInventoryImportRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.import'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsInventoryImportRoute({\n    request,\n    routePath: 'wms/inventory/import/apply',\n    mode: 'apply',\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.boolean(),\n  importBatchId: z.string().uuid(),\n  summary: z.object({\n    applied: z.number(),\n    skipped: z.number(),\n    failed: z.number(),\n  }),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Apply inventory CSV import',\n  methods: {\n    POST: {\n      summary: 'Apply inventory CSV import',\n      description:\n        'Applies validated inventory import rows via wms.inventory.adjust commands (idempotent skip when delta is zero).',\n      requestBody: { contentType: 'application/json', schema: inventoryImportApplySchema },\n      responses: [{ status: 200, description: 'Import applied', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Partial apply failure', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C,SAAS,sCAAsC;AAExC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,+BAA+B;AAAA,IACpC;AAAA,IACA,WAAW;AAAA,IACX,MAAM;AAAA,EACR,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO;AAAA,IAClB,SAAS,EAAE,OAAO;AAAA,IAClB,QAAQ,EAAE,OAAO;AAAA,EACnB,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,MACnF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,cAAc,CAAC;AAAA,MACjF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/import/helpers.js

@@ -0,0 +1,195 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+import { runCustomRouteAfterInterceptors } from "@open-mercato/shared/lib/crud/custom-route-interceptor";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { parseInventoryImportCsv } from "../../../lib/inventoryImportCsv.js";
+import { applyInventoryImport, validateInventoryImport } from "../../../lib/inventoryImportService.js";
+import {
+  inventoryImportApplySchema,
+  inventoryImportValidateSchema
+} from "../../../data/validators.js";
+const logger = createLogger("wms");
+function assertImportScope(ctx, input, translate) {
+  const forbidden = () => new CrudHttpError(403, { error: translate("wms.errors.forbidden", "Forbidden") });
+  if (ctx.auth?.isSuperAdmin === true) return;
+  const actorTenantId = ctx.auth?.tenantId ?? null;
+  if (!actorTenantId || actorTenantId !== input.tenantId) {
+    throw forbidden();
+  }
+  const allowedIds = ctx.organizationScope?.allowedIds ?? null;
+  if (Array.isArray(allowedIds)) {
+    if (!allowedIds.includes(input.organizationId)) throw forbidden();
+    return;
+  }
+  const selectedOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null;
+  if (!selectedOrganizationId || selectedOrganizationId !== input.organizationId) {
+    throw forbidden();
+  }
+}
+async function buildImportContext(request) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(request);
+  const { translate } = await resolveTranslations();
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, { error: translate("wms.errors.unauthorized", "Unauthorized") });
+  }
+  const organizationScope = await resolveOrganizationScopeForRequest({
+    container,
+    auth,
+    request
+  });
+  return {
+    container,
+    auth,
+    organizationScope,
+    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+    request
+  };
+}
+async function parseValidatePayload(request) {
+  const { translate } = await resolveTranslations();
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType.includes("multipart/form-data")) {
+    const formData = await request.formData();
+    const organizationId = String(formData.get("organizationId") ?? "").trim();
+    const tenantId = String(formData.get("tenantId") ?? "").trim();
+    const importBatchIdRaw = String(formData.get("importBatchId") ?? "").trim();
+    const skipDuplicatesRaw = String(formData.get("skipDuplicates") ?? "").trim();
+    const modeRaw = String(formData.get("mode") ?? "").trim();
+    const file = formData.get("file");
+    if (!(file instanceof File)) {
+      throw new CrudHttpError(400, {
+        error: translate("wms.backend.inventory.import.errors.csvFileRequired", "CSV file is required.")
+      });
+    }
+    const csvText = await file.text();
+    const rows = parseInventoryImportCsv(csvText);
+    return inventoryImportValidateSchema.parse({
+      organizationId,
+      tenantId,
+      ...importBatchIdRaw ? { importBatchId: importBatchIdRaw } : {},
+      ...skipDuplicatesRaw ? { skipDuplicates: skipDuplicatesRaw === "true" } : {},
+      ...modeRaw ? { mode: modeRaw } : {},
+      rows
+    });
+  }
+  const body = await readJsonSafe(request, {}) ?? {};
+  if (typeof body.csv === "string" && body.csv.trim().length > 0) {
+    const rows = parseInventoryImportCsv(body.csv);
+    return inventoryImportValidateSchema.parse({
+      ...body,
+      rows
+    });
+  }
+  return inventoryImportValidateSchema.parse(body);
+}
+async function executeWmsInventoryImportRoute(options) {
+  const { translate } = await resolveTranslations();
+  try {
+    const ctx = await buildImportContext(options.request);
+    const auth = ctx.auth;
+    if (!auth?.tenantId || !auth.sub) {
+      throw new CrudHttpError(401, { error: translate("wms.errors.unauthorized", "Unauthorized") });
+    }
+    if (options.mode === "validate") {
+      const parsed2 = await parseValidatePayload(options.request);
+      assertImportScope(ctx, parsed2, translate);
+      const result2 = await validateInventoryImport(ctx, parsed2);
+      return NextResponse.json(result2);
+    }
+    const parsed = inventoryImportApplySchema.parse(
+      await readJsonSafe(options.request, {}) ?? {}
+    );
+    assertImportScope(ctx, parsed, translate);
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId: auth.tenantId,
+      organizationId: ctx.selectedOrganizationId,
+      userId: auth.sub,
+      resourceKind: "wms.inventory",
+      resourceId: parsed.importBatchId,
+      operation: "custom",
+      requestMethod: options.request.method,
+      requestHeaders: options.request.headers,
+      mutationPayload: parsed
+    });
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status });
+    }
+    const result = await applyInventoryImport(ctx, {
+      ...parsed,
+      performedBy: auth.sub
+    });
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId: auth.tenantId,
+        organizationId: ctx.selectedOrganizationId,
+        userId: auth.sub,
+        resourceKind: "wms.inventory",
+        resourceId: parsed.importBatchId,
+        operation: "custom",
+        requestMethod: options.request.method,
+        requestHeaders: options.request.headers,
+        metadata: guardResult.metadata ?? null
+      });
+    }
+    const intercepted = await runCustomRouteAfterInterceptors({
+      routePath: options.routePath,
+      method: "POST",
+      request: {
+        method: "POST",
+        url: options.request.url,
+        body: parsed,
+        headers: Object.fromEntries(options.request.headers.entries())
+      },
+      response: {
+        statusCode: 200,
+        body: result,
+        headers: {}
+      },
+      context: {
+        em: ctx.container.resolve("em"),
+        container: ctx.container,
+        userId: auth.sub,
+        organizationId: ctx.selectedOrganizationId,
+        tenantId: auth.tenantId
+      }
+    });
+    if (!intercepted.ok) {
+      return NextResponse.json(intercepted.body, { status: intercepted.statusCode });
+    }
+    return NextResponse.json(intercepted.body, { status: intercepted.statusCode });
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json(
+        {
+          error: translate("wms.backend.inventory.import.errors.validationFailed", "Validation failed."),
+          details: error.issues
+        },
+        { status: 400 }
+      );
+    }
+    logger.error("inventory import route failed", { routePath: options.routePath, mode: options.mode, err: error });
+    return NextResponse.json(
+      { error: translate("wms.errors.internalServerError", "Internal server error") },
+      { status: 500 }
+    );
+  }
+}
+export {
+  executeWmsInventoryImportRoute
+};
+//# sourceMappingURL=helpers.js.map

package/dist/modules/wms/api/inventory/import/helpers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/wms/api/inventory/import/helpers.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { parseInventoryImportCsv } from '../../../lib/inventoryImportCsv'\nimport { applyInventoryImport, validateInventoryImport } from '../../../lib/inventoryImportService'\nimport {\n  inventoryImportApplySchema,\n  inventoryImportValidateSchema,\n} from '../../../data/validators'\n\nconst logger = createLogger('wms')\n\ntype ImportRouteOptions = {\n  request: Request\n  routePath: string\n  mode: 'validate' | 'apply'\n}\n\n/**\n * Fail-closed scope guard for inventory import payloads. Unlike the shared\n * `ensureOrganizationScope` (which short-circuits for tenant-wide admins with\n * `allowedIds === null`), this rejects payloads whose `organizationId`/`tenantId`\n * fall outside the caller's actively selected scope so cross-organization imports\n * cannot be smuggled through the request body.\n */\nfunction assertImportScope(\n  ctx: CommandRuntimeContext,\n  input: { organizationId: string; tenantId: string },\n  translate: (key: string, fallback?: string) => string,\n): void {\n  const forbidden = () =>\n    new CrudHttpError(403, { error: translate('wms.errors.forbidden', 'Forbidden') })\n  if (ctx.auth?.isSuperAdmin === true) return\n\n  const actorTenantId = ctx.auth?.tenantId ?? null\n  if (!actorTenantId || actorTenantId !== input.tenantId) {\n    throw forbidden()\n  }\n\n  const allowedIds = ctx.organizationScope?.allowedIds ?? null\n  if (Array.isArray(allowedIds)) {\n    if (!allowedIds.includes(input.organizationId)) throw forbidden()\n    return\n  }\n\n  const selectedOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!selectedOrganizationId || selectedOrganizationId !== input.organizationId) {\n    throw forbidden()\n  }\n}\n\nasync function buildImportContext(request: Request): Promise<CommandRuntimeContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(request)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request,\n  })\n  return {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request,\n  }\n}\n\nasync function parseValidatePayload(request: Request): Promise<z.infer<typeof inventoryImportValidateSchema>> {\n  const { translate } = await resolveTranslations()\n  const contentType = request.headers.get('content-type') ?? ''\n  if (contentType.includes('multipart/form-data')) {\n    const formData = await request.formData()\n    const organizationId = String(formData.get('organizationId') ?? '').trim()\n    const tenantId = String(formData.get('tenantId') ?? '').trim()\n    const importBatchIdRaw = String(formData.get('importBatchId') ?? '').trim()\n    const skipDuplicatesRaw = String(formData.get('skipDuplicates') ?? '').trim()\n    const modeRaw = String(formData.get('mode') ?? '').trim()\n    const file = formData.get('file')\n    if (!(file instanceof File)) {\n      throw new CrudHttpError(400, {\n        error: translate('wms.backend.inventory.import.errors.csvFileRequired', 'CSV file is required.'),\n      })\n    }\n    const csvText = await file.text()\n    const rows = parseInventoryImportCsv(csvText)\n    return inventoryImportValidateSchema.parse({\n      organizationId,\n      tenantId,\n      ...(importBatchIdRaw ? { importBatchId: importBatchIdRaw } : {}),\n      ...(skipDuplicatesRaw ? { skipDuplicates: skipDuplicatesRaw === 'true' } : {}),\n      ...(modeRaw ? { mode: modeRaw } : {}),\n      rows,\n    })\n  }\n\n  const body = (await readJsonSafe<Record<string, unknown>>(request, {})) ?? {}\n  if (typeof body.csv === 'string' && body.csv.trim().length > 0) {\n    const rows = parseInventoryImportCsv(body.csv)\n    return inventoryImportValidateSchema.parse({\n      ...body,\n      rows,\n    })\n  }\n  return inventoryImportValidateSchema.parse(body)\n}\n\nexport async function executeWmsInventoryImportRoute(options: ImportRouteOptions) {\n  const { translate } = await resolveTranslations()\n  try {\n    const ctx = await buildImportContext(options.request)\n    const auth = ctx.auth\n    if (!auth?.tenantId || !auth.sub) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n\n    if (options.mode === 'validate') {\n      const parsed = await parseValidatePayload(options.request)\n      assertImportScope(ctx, parsed, translate)\n      const result = await validateInventoryImport(ctx, parsed)\n      return NextResponse.json(result)\n    }\n\n    const parsed = inventoryImportApplySchema.parse(\n      (await readJsonSafe<Record<string, unknown>>(options.request, {})) ?? {},\n    )\n    assertImportScope(ctx, parsed, translate)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: 'wms.inventory',\n      resourceId: parsed.importBatchId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const result = await applyInventoryImport(ctx, {\n      ...parsed,\n      performedBy: auth.sub,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: 'wms.inventory',\n        resourceId: parsed.importBatchId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: result as Record<string, unknown>,\n        headers: {},\n      },\n      context: {\n        em: ctx.container.resolve('em'),\n        container: ctx.container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate('wms.backend.inventory.import.errors.validationFailed', 'Validation failed.'),\n          details: error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('inventory import route failed', { routePath: options.routePath, mode: options.mode, err: error })\n    return NextResponse.json(\n      { error: translate('wms.errors.internalServerError', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,+BAA+B;AACxC,SAAS,sBAAsB,+BAA+B;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,KAAK;AAejC,SAAS,kBACP,KACA,OACA,WACM;AACN,QAAM,YAAY,MAChB,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,CAAC;AAClF,MAAI,IAAI,MAAM,iBAAiB,KAAM;AAErC,QAAM,gBAAgB,IAAI,MAAM,YAAY;AAC5C,MAAI,CAAC,iBAAiB,kBAAkB,MAAM,UAAU;AACtD,UAAM,UAAU;AAAA,EAClB;AAEA,QAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,QAAI,CAAC,WAAW,SAAS,MAAM,cAAc,EAAG,OAAM,UAAU;AAChE;AAAA,EACF;AAEA,QAAM,yBAAyB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAChF,MAAI,CAAC,0BAA0B,2BAA2B,MAAM,gBAAgB;AAC9E,UAAM,UAAU;AAAA,EAClB;AACF;AAEA,eAAe,mBAAmB,SAAkD;AAClF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,EAC9F;AACA,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,IACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,SAA0E;AAC5G,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,WAAW,MAAM,QAAQ,SAAS;AACxC,UAAM,iBAAiB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AACzE,UAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,KAAK;AAC7D,UAAM,mBAAmB,OAAO,SAAS,IAAI,eAAe,KAAK,EAAE,EAAE,KAAK;AAC1E,UAAM,oBAAoB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AAC5E,UAAM,UAAU,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACxD,UAAM,OAAO,SAAS,IAAI,MAAM;AAChC,QAAI,EAAE,gBAAgB,OAAO;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uDAAuD,uBAAuB;AAAA,MACjG,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAM,OAAO,wBAAwB,OAAO;AAC5C,WAAO,8BAA8B,MAAM;AAAA,MACzC;AAAA,MACA;AAAA,MACA,GAAI,mBAAmB,EAAE,eAAe,iBAAiB,IAAI,CAAC;AAAA,MAC9D,GAAI,oBAAoB,EAAE,gBAAgB,sBAAsB,OAAO,IAAI,CAAC;AAAA,MAC5E,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,OAAQ,MAAM,aAAsC,SAAS,CAAC,CAAC,KAAM,CAAC;AAC5E,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,GAAG;AAC9D,UAAM,OAAO,wBAAwB,KAAK,GAAG;AAC7C,WAAO,8BAA8B,MAAM;AAAA,MACzC,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,8BAA8B,MAAM,IAAI;AACjD;AAEA,eAAsB,+BAA+B,SAA6B;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,MAAM,MAAM,mBAAmB,QAAQ,OAAO;AACpD,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,YAAY,CAAC,KAAK,KAAK;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS,YAAY;AAC/B,YAAMA,UAAS,MAAM,qBAAqB,QAAQ,OAAO;AACzD,wBAAkB,KAAKA,SAAQ,SAAS;AACxC,YAAMC,UAAS,MAAM,wBAAwB,KAAKD,OAAM;AACxD,aAAO,aAAa,KAAKC,OAAM;AAAA,IACjC;AAEA,UAAM,SAAS,2BAA2B;AAAA,MACvC,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC,KAAM,CAAC;AAAA,IACzE;AACA,sBAAkB,KAAK,QAAQ,SAAS;AACxC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,qBAAqB,KAAK;AAAA,MAC7C,GAAG;AAAA,MACH,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC9B,WAAW,IAAI;AAAA,QACf,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,wDAAwD,oBAAoB;AAAA,UAC7F,SAAS,MAAM;AAAA,QACjB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,iCAAiC,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,uBAAuB,EAAE;AAAA,MAC9E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "names": ["parsed", "result"]
+}

package/dist/modules/wms/api/inventory/import/template/route.js

@@ -0,0 +1,32 @@
+import { NextResponse } from "next/server";
+import { buildInventoryImportTemplateCsv } from "../../../../lib/inventoryImportCsv.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["wms.import"] }
+};
+async function GET() {
+  const csv = buildInventoryImportTemplateCsv();
+  return new NextResponse(csv, {
+    status: 200,
+    headers: {
+      "content-type": "text/csv; charset=utf-8",
+      "content-disposition": 'attachment; filename="wms-inventory-import-template.csv"'
+    }
+  });
+}
+const openApi = {
+  tag: "WMS",
+  summary: "Download inventory import CSV template",
+  methods: {
+    GET: {
+      summary: "Download inventory import CSV template",
+      description: 'Returns a CSV template for WMS inventory imports. By default the quantity column is added to existing on-hand stock; the "Reconcile to exact balance" import option treats it as the absolute target balance instead.',
+      responses: [{ status: 200, description: "CSV template file" }]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/inventory/import/template/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/wms/api/inventory/import/template/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildInventoryImportTemplateCsv } from '../../../../lib/inventoryImportCsv'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.import'] },\n}\n\nexport async function GET() {\n  const csv = buildInventoryImportTemplateCsv()\n  return new NextResponse(csv, {\n    status: 200,\n    headers: {\n      'content-type': 'text/csv; charset=utf-8',\n      'content-disposition': 'attachment; filename=\"wms-inventory-import-template.csv\"',\n    },\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Download inventory import CSV template',\n  methods: {\n    GET: {\n      summary: 'Download inventory import CSV template',\n      description:\n        'Returns a CSV template for WMS inventory imports. By default the quantity column is added to existing on-hand stock; the \"Reconcile to exact balance\" import option treats it as the absolute target balance instead.',\n      responses: [{ status: 200, description: 'CSV template file' }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,uCAAuC;AAEzC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,eAAsB,MAAM;AAC1B,QAAM,MAAM,gCAAgC;AAC5C,SAAO,IAAI,aAAa,KAAK;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/import/validate/route.js

@@ -0,0 +1,54 @@
+import { z } from "zod";
+import { inventoryImportValidateSchema } from "../../../../data/validators.js";
+import { executeWmsInventoryImportRoute } from "../helpers.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.import"] }
+};
+async function POST(request) {
+  return executeWmsInventoryImportRoute({
+    request,
+    routePath: "wms/inventory/import/validate",
+    mode: "validate"
+  });
+}
+const rowResultSchema = z.object({
+  rowNumber: z.number(),
+  status: z.enum(["valid", "error", "warning", "skip"]),
+  errors: z.array(z.string()),
+  warnings: z.array(z.string())
+});
+const successSchema = z.object({
+  ok: z.boolean(),
+  importBatchId: z.string().uuid(),
+  summary: z.object({
+    totalRows: z.number(),
+    validRows: z.number(),
+    errorRows: z.number(),
+    warningRows: z.number(),
+    skipRows: z.number()
+  }),
+  rows: z.array(rowResultSchema)
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "WMS",
+  summary: "Validate inventory CSV import",
+  methods: {
+    POST: {
+      summary: "Validate inventory CSV import",
+      description: 'Dry-run validation for inventory import CSV rows. By default (mode "additive"), quantity is added to existing on-hand stock; opt into mode "reconcile" to instead treat quantity as the absolute target balance (overwrites existing stock, including reducing it). Accepts JSON rows, JSON csv text, or multipart file upload.',
+      requestBody: { contentType: "application/json", schema: inventoryImportValidateSchema },
+      responses: [{ status: 200, description: "Validation report", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/inventory/import/validate/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/wms/api/inventory/import/validate/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryImportValidateSchema } from '../../../../data/validators'\nimport { executeWmsInventoryImportRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.import'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsInventoryImportRoute({\n    request,\n    routePath: 'wms/inventory/import/validate',\n    mode: 'validate',\n  })\n}\n\nconst rowResultSchema = z.object({\n  rowNumber: z.number(),\n  status: z.enum(['valid', 'error', 'warning', 'skip']),\n  errors: z.array(z.string()),\n  warnings: z.array(z.string()),\n})\n\nconst successSchema = z.object({\n  ok: z.boolean(),\n  importBatchId: z.string().uuid(),\n  summary: z.object({\n    totalRows: z.number(),\n    validRows: z.number(),\n    errorRows: z.number(),\n    warningRows: z.number(),\n    skipRows: z.number(),\n  }),\n  rows: z.array(rowResultSchema),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Validate inventory CSV import',\n  methods: {\n    POST: {\n      summary: 'Validate inventory CSV import',\n      description:\n        'Dry-run validation for inventory import CSV rows. By default (mode \"additive\"), quantity is added to existing on-hand stock; opt into mode \"reconcile\" to instead treat quantity as the absolute target balance (overwrites existing stock, including reducing it). Accepts JSON rows, JSON csv text, or multipart file upload.',\n      requestBody: { contentType: 'application/json', schema: inventoryImportValidateSchema },\n      responses: [{ status: 200, description: 'Validation report', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,qCAAqC;AAC9C,SAAS,sCAAsC;AAExC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC7D;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,+BAA+B;AAAA,IACpC;AAAA,IACA,WAAW;AAAA,IACX,MAAM;AAAA,EACR,CAAC;AACH;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,KAAK,CAAC,SAAS,SAAS,WAAW,MAAM,CAAC;AAAA,EACpD,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC1B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAC9B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO;AAAA,IAChB,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,IACpB,aAAa,EAAE,OAAO;AAAA,IACtB,UAAU,EAAE,OAAO;AAAA,EACrB,CAAC;AAAA,EACD,MAAM,EAAE,MAAM,eAAe;AAC/B,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MACtF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,cAAc,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/move/route.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { inventoryMoveSchema } from "../../../data/validators.js";
+import { executeWmsCustomPostRoute } from "../helpers.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["wms.adjust_inventory"] }
+};
+async function POST(request) {
+  return executeWmsCustomPostRoute({
+    request,
+    routePath: "wms/inventory/move",
+    inputSchema: inventoryMoveSchema,
+    commandId: "wms.inventory.move",
+    describeResource: (input) => ({
+      resourceKind: "wms.inventory",
+      resourceId: `${input.warehouseId}:${input.fromLocationId}:${input.catalogVariantId}`
+    }),
+    mapSuccess: (result) => ({
+      ok: true,
+      movementId: result.movementId
+    })
+  });
+}
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementId: z.string().uuid()
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "WMS",
+  summary: "Move inventory",
+  methods: {
+    POST: {
+      summary: "Move inventory",
+      description: "Moves stock from one location to another within a warehouse and appends a transfer movement.",
+      requestBody: { contentType: "application/json", schema: inventoryMoveSchema },
+      responses: [{ status: 200, description: "Inventory moved", schema: successSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 409, description: "Insufficient stock", schema: errorSchema },
+        { status: 422, description: "Invalid location", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/wms/api/inventory/move/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/wms/api/inventory/move/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryMoveSchema } from '../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.adjust_inventory'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsCustomPostRoute({\n    request,\n    routePath: 'wms/inventory/move',\n    inputSchema: inventoryMoveSchema,\n    commandId: 'wms.inventory.move',\n    describeResource: (input) => ({\n      resourceKind: 'wms.inventory',\n      resourceId: `${input.warehouseId}:${input.fromLocationId}:${input.catalogVariantId}`,\n    }),\n    mapSuccess: (result: { movementId: string }) => ({\n      ok: true,\n      movementId: result.movementId,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  movementId: z.string().uuid(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Move inventory',\n  methods: {\n    POST: {\n      summary: 'Move inventory',\n      description: 'Moves stock from one location to another within a warehouse and appends a transfer movement.',\n      requestBody: { contentType: 'application/json', schema: inventoryMoveSchema },\n      responses: [{ status: 200, description: 'Inventory moved', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Insufficient stock', schema: errorSchema },\n        { status: 422, description: 'Invalid location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,0BAA0B;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,GAAG,MAAM,WAAW,IAAI,MAAM,cAAc,IAAI,MAAM,gBAAgB;AAAA,IACpF;AAAA,IACA,YAAY,CAAC,YAAoC;AAAA,MAC/C,IAAI;AAAA,MACJ,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,KAAK;AAC9B,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC5E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,cAAc,CAAC;AAAA,MAClF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,YAAY;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/wms/api/inventory/movements/route.js

@@ -0,0 +1,164 @@
+import { z } from "zod";
+import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { E } from "../../../../../generated/entities.ids.generated.js";
+import { InventoryMovement } from "../../../data/entities.js";
+import { inventoryMovementListQuerySchema } from "../../../data/validators.js";
+import { createPagedListResponseSchema } from "../../openapi.js";
+import {
+  attachLocationLabelsToListItems,
+  attachVariantLabelsToListItems,
+  attachWarehouseLabelsToListItems
+} from "../../listEnrichers.js";
+import { buildInventoryListSearchOrFilters } from "../../listSearch.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["wms.view"] }
+};
+const crud = makeCrudRoute({
+  metadata,
+  orm: {
+    entity: InventoryMovement,
+    idField: "id",
+    orgField: "organizationId",
+    tenantField: "tenantId",
+    softDeleteField: "deletedAt"
+  },
+  indexer: { entityType: E.wms.inventory_movement },
+  list: {
+    schema: inventoryMovementListQuerySchema,
+    entityId: E.wms.inventory_movement,
+    disableListCache: true,
+    fields: [
+      "id",
+      "organization_id",
+      "tenant_id",
+      "warehouse_id",
+      "location_from_id",
+      "location_to_id",
+      "catalog_variant_id",
+      "lot_id",
+      "serial_number",
+      "quantity",
+      "type",
+      "reference_type",
+      "reference_id",
+      "performed_by",
+      "performed_at",
+      "received_at",
+      "reason",
+      "reason_code",
+      "created_at",
+      "updated_at"
+    ],
+    sortFieldMap: {
+      catalogVariantId: "catalog_variant_id",
+      warehouseId: "warehouse_id",
+      quantity: "quantity",
+      type: "type",
+      performedAt: "performed_at",
+      receivedAt: "received_at",
+      createdAt: "created_at",
+      updatedAt: "updated_at"
+    },
+    buildFilters: async (query, ctx) => {
+      const filters = {};
+      if (query.warehouseId) filters.warehouse_id = { $eq: query.warehouseId };
+      if (query.catalogVariantId) filters.catalog_variant_id = { $eq: query.catalogVariantId };
+      if (query.lotId) filters.lot_id = { $eq: query.lotId };
+      if (query.referenceType) filters.reference_type = { $eq: query.referenceType };
+      if (query.referenceId) filters.reference_id = { $eq: query.referenceId };
+      if (query.type) filters.type = { $eq: query.type };
+      const andFilters = [];
+      if (query.locationId) {
+        andFilters.push({
+          $or: [
+            { location_from_id: { $eq: query.locationId } },
+            { location_to_id: { $eq: query.locationId } }
+          ]
+        });
+      }
+      const term = query.search?.trim();
+      if (term) {
+        andFilters.push({
+          $or: await buildInventoryListSearchOrFilters(ctx, term, escapeLikePattern, {
+            extraFieldFilters: (like) => [
+              { reason: { $ilike: like } },
+              { reason_code: { $ilike: like } }
+            ]
+          })
+        });
+      }
+      if (andFilters.length === 1) {
+        Object.assign(filters, andFilters[0]);
+      } else if (andFilters.length > 1) {
+        filters.$and = andFilters;
+      }
+      return filters;
+    }
+  },
+  hooks: {
+    afterList: async (payload, ctx) => {
+      await Promise.all([
+        attachWarehouseLabelsToListItems(payload, ctx),
+        attachLocationLabelsToListItems(payload, ctx),
+        attachVariantLabelsToListItems(payload, ctx)
+      ]);
+    }
+  }
+});
+const GET = crud.GET;
+const movementListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  warehouse_id: z.string().uuid().nullable().optional(),
+  warehouse_name: z.string().nullable().optional(),
+  warehouse_code: z.string().nullable().optional(),
+  location_from_id: z.string().uuid().nullable().optional(),
+  location_from_code: z.string().nullable().optional(),
+  location_from_type: z.string().nullable().optional(),
+  location_to_id: z.string().uuid().nullable().optional(),
+  location_to_code: z.string().nullable().optional(),
+  location_to_type: z.string().nullable().optional(),
+  catalog_variant_id: z.string().uuid().nullable().optional(),
+  catalog_product_id: z.string().uuid().nullable().optional(),
+  variant_name: z.string().nullable().optional(),
+  variant_sku: z.string().nullable().optional(),
+  lot_id: z.string().uuid().nullable().optional(),
+  serial_number: z.string().nullable().optional(),
+  quantity: z.union([z.string(), z.number()]).nullable().optional(),
+  type: z.string().nullable().optional(),
+  reference_type: z.string().nullable().optional(),
+  reference_id: z.string().uuid().nullable().optional(),
+  performed_by: z.string().uuid().nullable().optional(),
+  performed_at: z.string().nullable().optional(),
+  received_at: z.string().nullable().optional(),
+  reason: z.string().nullable().optional(),
+  reason_code: z.string().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional()
+});
+const openApi = {
+  tag: "WMS",
+  summary: "Inventory movements",
+  methods: {
+    GET: {
+      summary: "List inventory movements",
+      description: "Returns paginated inventory ledger entries for the authenticated organization.",
+      query: inventoryMovementListQuerySchema,
+      responses: [
+        {
+          status: 200,
+          description: "Inventory movements collection",
+          schema: createPagedListResponseSchema(movementListItemSchema)
+        }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map