@open-mercato/core 0.6.7-develop.6785.1.1dd7cfac55 → 0.6.7-develop.6795.1.8a3f27921c

package/dist/modules/data_sync/api/mappings/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/data_sync/api/mappings/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst listMappingsQuerySchema = z.object({\n  integrationId: z.string().min(1).optional(),\n  entityType: z.string().min(1).optional(),\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n})\n\nconst createMappingSchema = z.object({\n  integrationId: z.string().min(1),\n  entityType: z.string().min(1),\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create field mappings',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listMappingsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const where: FilterQuery<SyncMapping> = {\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  }\n  if (parsed.data.integrationId) where.integrationId = parsed.data.integrationId\n  if (parsed.data.entityType) where.entityType = parsed.data.entityType\n\n  const [items, total] = await findAndCountWithDecryption(\n    em,\n    SyncMapping,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: parsed.data.pageSize,\n      offset: (parsed.data.page - 1) * parsed.data.pageSize,\n    },\n    scope,\n  )\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      mapping: item.mapping,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsed = createMappingSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const existing = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      integrationId: parsed.data.integrationId,\n      entityType: parsed.data.entityType,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: existing?.id ?? scope.organizationId,\n    operation: existing ? 'update' : 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  if (existing) {\n    existing.mapping = parsed.data.mapping\n    await em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.mapping',\n        resourceId: existing.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: existing.id,\n      integrationId: existing.integrationId,\n      entityType: existing.entityType,\n      mapping: existing.mapping,\n    })\n  }\n\n  const created = em.create(SyncMapping, {\n    integrationId: parsed.data.integrationId,\n    entityType: parsed.data.entityType,\n    mapping: parsed.data.mapping,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  await em.persist(created).flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: created.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: created.id,\n    integrationId: created.integrationId,\n    entityType: created.entityType,\n    mapping: created.mapping,\n  }, { status: 201 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,6BAA6B;AAClE,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC9D,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,QAAkC;AAAA,IACtC,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,cAAe,OAAM,gBAAgB,OAAO,KAAK;AACjE,MAAI,OAAO,KAAK,WAAY,OAAM,aAAa,OAAO,KAAK;AAE3D,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,OAAO,KAAK;AAAA,MACnB,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK;AAAA,MACd,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,OAAO,KAAK;AAAA,MAC3B,YAAY,OAAO,KAAK;AAAA,MACxB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,UAAU,MAAM,MAAM;AAAA,IAClC,WAAW,WAAW,WAAW;AAAA,IACjC,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,UAAU;AACZ,aAAS,UAAU,OAAO,KAAK;AAC/B,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,GAAG,OAAO,aAAa;AAAA,IACrC,eAAe,OAAO,KAAK;AAAA,IAC3B,YAAY,OAAO,KAAK;AAAA,IACxB,SAAS,OAAO,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAEhC,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,EACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst listMappingsQuerySchema = z.object({\n  integrationId: z.string().min(1).optional(),\n  entityType: z.string().min(1).optional(),\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n})\n\nconst createMappingSchema = z.object({\n  integrationId: z.string().min(1),\n  entityType: z.string().min(1),\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create field mappings',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const url = new URL(req.url)\n  const parsed = listMappingsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const where: FilterQuery<SyncMapping> = {\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  }\n  if (parsed.data.integrationId) where.integrationId = parsed.data.integrationId\n  if (parsed.data.entityType) where.entityType = parsed.data.entityType\n\n  const [items, total] = await findAndCountWithDecryption(\n    em,\n    SyncMapping,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: parsed.data.pageSize,\n      offset: (parsed.data.page - 1) * parsed.data.pageSize,\n    },\n    scope,\n  )\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      mapping: item.mapping,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsed = createMappingSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const existing = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      integrationId: parsed.data.integrationId,\n      entityType: parsed.data.entityType,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: existing?.id ?? scope.organizationId,\n    operation: existing ? 'update' : 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  if (existing) {\n    existing.mapping = parsed.data.mapping\n    await em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.mapping',\n        resourceId: existing.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: existing.id,\n      integrationId: existing.integrationId,\n      entityType: existing.entityType,\n      mapping: existing.mapping,\n    })\n  }\n\n  const created = em.create(SyncMapping, {\n    integrationId: parsed.data.integrationId,\n    entityType: parsed.data.entityType,\n    mapping: parsed.data.mapping,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  await em.persist(created).flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: created.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: created.id,\n    integrationId: created.integrationId,\n    entityType: created.entityType,\n    mapping: created.mapping,\n  }, { status: 201 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,6BAA6B;AAClE,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC9D,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAkC;AAAA,IACtC,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,cAAe,OAAM,gBAAgB,OAAO,KAAK;AACjE,MAAI,OAAO,KAAK,WAAY,OAAM,aAAa,OAAO,KAAK;AAE3D,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,OAAO,KAAK;AAAA,MACnB,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK;AAAA,MACd,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,OAAO,KAAK;AAAA,MAC3B,YAAY,OAAO,KAAK;AAAA,MACxB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,UAAU,MAAM,MAAM;AAAA,IAClC,WAAW,WAAW,WAAW;AAAA,IACjC,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,UAAU;AACZ,aAAS,UAAU,OAAO,KAAK;AAC/B,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,GAAG,OAAO,aAAa;AAAA,IACrC,eAAe,OAAO,KAAK;AAAA,IAC3B,YAAY,OAAO,KAAK;AAAA,IACxB,SAAS,OAAO,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAEhC,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,EACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;",
   "names": []
 }

package/dist/modules/data_sync/api/options.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAllIntegrations } from "@open-mercato/shared/modules/integrations/types";
 import { getDataSyncAdapter } from "../lib/adapter-registry.js";
@@ -12,13 +13,17 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const container = await createRequestContainer();
   const credentialsService = container.resolve("integrationCredentialsService");
   const stateService = container.resolve("integrationStateService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const items = await Promise.all(
     getAllIntegrations().filter((integration) => integration.hub === "data_sync" && integration.providerKey).map(async (integration) => {
       const adapter = getDataSyncAdapter(integration.providerKey);

package/dist/modules/data_sync/api/options.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/options.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/run.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
@@ -22,9 +23,13 @@ const openApi = {
 async function POST(req) {
   try {
     const auth = await getAuthFromRequest(req);
-    if (!auth?.tenantId || !auth.orgId) {
+    if (!auth?.tenantId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
+    const organizationId = resolveActiveOrganizationId(auth);
+    if (!organizationId) {
+      return organizationScopeRequiredResponse();
+    }
     const payload = await readJsonSafe(req);
     const parsed = runSyncSchema.safeParse(payload);
     if (!parsed.success) {
@@ -35,7 +40,7 @@ async function POST(req) {
     const progressService = container.resolve("progressService");
     const integrationStateService = container.resolve("integrationStateService");
     const scope = {
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     };
     const integration = getIntegration(parsed.data.integrationId);

package/dist/modules/data_sync/api/run.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/run.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { ProgressService } from '../../progress/lib/progressService'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { SyncRunService } from '../lib/sync-run-service'\nimport { runSyncSchema } from '../data/validators'\nimport { startDataSyncRun } from '../lib/start-run'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('data_sync').child({ component: 'run' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Start a data sync run',\n}\n\nexport async function POST(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId || !auth.orgId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const payload = await readJsonSafe(req)\n    const parsed = runSyncSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n\n    const scope = {\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    }\n\n    const integration = getIntegration(parsed.data.integrationId)\n    if (!integration?.providerKey) {\n      return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n    }\n\n    const adapter = getDataSyncAdapter(integration.providerKey)\n    if (!adapter) {\n      return NextResponse.json({ error: 'No registered sync adapter for provider' }, { status: 404 })\n    }\n    if (adapter.runMode === 'provider') {\n      return NextResponse.json(\n        {\n          error: 'This integration must be started from its provider-specific import flow.',\n          settingsPath: `/backend/integrations/${encodeURIComponent(parsed.data.integrationId)}`,\n        },\n        { status: 422 },\n      )\n    }\n\n    if (!adapter.supportedEntities.includes(parsed.data.entityType)) {\n      return NextResponse.json({ error: 'Unsupported entity type for this integration' }, { status: 422 })\n    }\n\n    const integrationEnabled = await integrationStateService.isEnabled(parsed.data.integrationId, scope)\n    if (!integrationEnabled) {\n      return NextResponse.json({ error: 'Integration is disabled' }, { status: 409 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap(\n      parsed.data.integrationId,\n      parsed.data.entityType,\n      parsed.data.direction,\n      scope,\n    )\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: parsed.data.integrationId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const cursor = parsed.data.fullSync\n      ? null\n      : await syncRunService.resolveCursor(parsed.data.integrationId, parsed.data.entityType, parsed.data.direction, scope)\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: parsed.data.integrationId,\n        entityType: parsed.data.entityType,\n        direction: parsed.data.direction,\n        cursor,\n        triggeredBy: parsed.data.triggeredBy ?? auth.sub,\n        batchSize: parsed.data.batchSize,\n      },\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.run',\n        resourceId: run.id,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting sync run', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start data sync run.' },\n      { status: 500 },\n    )\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAI/B,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE5D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAE3E,UAAM,QAAQ;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAEA,UAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,QAAI,CAAC,aAAa,aAAa;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChG;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,cAAc,yBAAyB,mBAAmB,OAAO,KAAK,aAAa,CAAC;AAAA,QACtF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,kBAAkB,SAAS,OAAO,KAAK,UAAU,GAAG;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AAEA,UAAM,qBAAqB,MAAM,wBAAwB,UAAU,OAAO,KAAK,eAAe,KAAK;AACnG,QAAI,CAAC,oBAAoB;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,UAAU,MAAM,eAAe;AAAA,MACnC,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AACA,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpI;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,OAAO,KAAK,WACvB,OACA,MAAM,eAAe,cAAc,OAAO,KAAK,eAAe,OAAO,KAAK,YAAY,OAAO,KAAK,WAAW,KAAK;AAEtH,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe,OAAO,KAAK;AAAA,QAC3B,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW,OAAO,KAAK;AAAA,QACvB;AAAA,QACA,aAAa,OAAO,KAAK,eAAe,KAAK;AAAA,QAC7C,WAAW,OAAO,KAAK;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClG,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,CAAC;AACpE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,iCAAiC;AAAA,MAC1C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { ProgressService } from '../../progress/lib/progressService'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { SyncRunService } from '../lib/sync-run-service'\nimport { runSyncSchema } from '../data/validators'\nimport { startDataSyncRun } from '../lib/start-run'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('data_sync').child({ component: 'run' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Start a data sync run',\n}\n\nexport async function POST(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) {\n      return organizationScopeRequiredResponse()\n    }\n\n    const payload = await readJsonSafe(req)\n    const parsed = runSyncSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n\n    const scope = {\n      organizationId,\n      tenantId: auth.tenantId,\n    }\n\n    const integration = getIntegration(parsed.data.integrationId)\n    if (!integration?.providerKey) {\n      return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n    }\n\n    const adapter = getDataSyncAdapter(integration.providerKey)\n    if (!adapter) {\n      return NextResponse.json({ error: 'No registered sync adapter for provider' }, { status: 404 })\n    }\n    if (adapter.runMode === 'provider') {\n      return NextResponse.json(\n        {\n          error: 'This integration must be started from its provider-specific import flow.',\n          settingsPath: `/backend/integrations/${encodeURIComponent(parsed.data.integrationId)}`,\n        },\n        { status: 422 },\n      )\n    }\n\n    if (!adapter.supportedEntities.includes(parsed.data.entityType)) {\n      return NextResponse.json({ error: 'Unsupported entity type for this integration' }, { status: 422 })\n    }\n\n    const integrationEnabled = await integrationStateService.isEnabled(parsed.data.integrationId, scope)\n    if (!integrationEnabled) {\n      return NextResponse.json({ error: 'Integration is disabled' }, { status: 409 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap(\n      parsed.data.integrationId,\n      parsed.data.entityType,\n      parsed.data.direction,\n      scope,\n    )\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: parsed.data.integrationId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const cursor = parsed.data.fullSync\n      ? null\n      : await syncRunService.resolveCursor(parsed.data.integrationId, parsed.data.entityType, parsed.data.direction, scope)\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: parsed.data.integrationId,\n        entityType: parsed.data.entityType,\n        direction: parsed.data.direction,\n        cursor,\n        triggeredBy: parsed.data.triggeredBy ?? auth.sub,\n        batchSize: parsed.data.batchSize,\n      },\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.run',\n        resourceId: run.id,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting sync run', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start data sync run.' },\n      { status: 500 },\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAI/B,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE5D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,gBAAgB;AACnB,aAAO,kCAAkC;AAAA,IAC3C;AAEA,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAE3E,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAEA,UAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,QAAI,CAAC,aAAa,aAAa;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChG;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,cAAc,yBAAyB,mBAAmB,OAAO,KAAK,aAAa,CAAC;AAAA,QACtF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,kBAAkB,SAAS,OAAO,KAAK,UAAU,GAAG;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AAEA,UAAM,qBAAqB,MAAM,wBAAwB,UAAU,OAAO,KAAK,eAAe,KAAK;AACnG,QAAI,CAAC,oBAAoB;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,UAAU,MAAM,eAAe;AAAA,MACnC,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AACA,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpI;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,OAAO,KAAK,WACvB,OACA,MAAM,eAAe,cAAc,OAAO,KAAK,eAAe,OAAO,KAAK,YAAY,OAAO,KAAK,WAAW,KAAK;AAEtH,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe,OAAO,KAAK;AAAA,QAC3B,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW,OAAO,KAAK;AAAA,QACvB;AAAA,QACA,aAAa,OAAO,KAAK,eAAe,KAAK;AAAA,QAC7C,WAAW,OAAO,KAAK;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClG,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,CAAC;AACpE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,iCAAiC;AAAA,MAC1C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/cancel.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import {
   runCrudMutationGuardAfterSuccess,
@@ -16,9 +17,13 @@ const openApi = {
 };
 async function POST(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsed = paramsSchema.safeParse(rawParams);
   if (!parsed.success) {
@@ -29,7 +34,7 @@ async function POST(req, ctx) {
   const progressService = container.resolve("progressService");
   const integrationLogService = container.resolve("integrationLogService");
   const integrationStateService = container.resolve("integrationStateService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const run = await syncRunService.getRun(parsed.data.id, scope);
   if (!run) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });
@@ -53,7 +58,7 @@ async function POST(req, ctx) {
   }
   const progressCtx = {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     userId: auth.sub
   };
   if (run.progressJobId) {

package/dist/modules/data_sync/api/runs/[id]/cancel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/cancel.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { IntegrationStateService } from '../../../../integrations/lib/state-service'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Cancel a running sync',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService\n  const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (run.status !== 'running' && run.status !== 'pending') {\n    return NextResponse.json({ error: 'Only pending or running runs can be cancelled' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: run.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'cancel' },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const progressCtx = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  }\n\n  if (run.progressJobId) {\n    try {\n      await progressService.markCancelled(run.progressJobId, progressCtx)\n    } catch (error) {\n      const job = await progressService.getJob(run.progressJobId, progressCtx)\n      const cancelRequested = job && (job.status === 'running' || job.status === 'cancelled')\n        ? await progressService.isCancellationRequested(run.progressJobId, progressCtx.tenantId, progressCtx.organizationId)\n        : false\n\n      if (job?.status !== 'cancelled' && !cancelRequested) {\n        throw error\n      }\n    }\n  }\n\n  await syncRunService.markStatus(run.id, 'cancelled', scope)\n  await integrationStateService.upsert(run.integrationId, {\n    lastHealthStatus: 'degraded',\n    lastHealthCheckedAt: new Date(),\n  }, scope)\n  await integrationLogService.write({\n    integrationId: run.integrationId,\n    runId: run.id,\n    level: 'warn',\n    message: 'Sync run cancelled',\n    payload: {\n      operationalStatus: 'cancelled',\n      summary: 'The sync run was cancelled before completion.',\n    },\n  }, scope)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAKvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AACvE,QAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,IAAI,WAAW,aAAa,IAAI,WAAW,WAAW;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,gDAAgD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf;AAEA,MAAI,IAAI,eAAe;AACrB,QAAI;AACF,YAAM,gBAAgB,cAAc,IAAI,eAAe,WAAW;AAAA,IACpE,SAAS,OAAO;AACd,YAAM,MAAM,MAAM,gBAAgB,OAAO,IAAI,eAAe,WAAW;AACvE,YAAM,kBAAkB,QAAQ,IAAI,WAAW,aAAa,IAAI,WAAW,eACvE,MAAM,gBAAgB,wBAAwB,IAAI,eAAe,YAAY,UAAU,YAAY,cAAc,IACjH;AAEJ,UAAI,KAAK,WAAW,eAAe,CAAC,iBAAiB;AACnD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,IAAI,IAAI,aAAa,KAAK;AAC1D,QAAM,wBAAwB,OAAO,IAAI,eAAe;AAAA,IACtD,kBAAkB;AAAA,IAClB,qBAAqB,oBAAI,KAAK;AAAA,EAChC,GAAG,KAAK;AACR,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,IAAI;AAAA,IACnB,OAAO,IAAI;AAAA,IACX,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS;AAAA,MACP,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF,GAAG,KAAK;AAER,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { IntegrationStateService } from '../../../../integrations/lib/state-service'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Cancel a running sync',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService\n  const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (run.status !== 'running' && run.status !== 'pending') {\n    return NextResponse.json({ error: 'Only pending or running runs can be cancelled' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: run.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'cancel' },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const progressCtx = {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub,\n  }\n\n  if (run.progressJobId) {\n    try {\n      await progressService.markCancelled(run.progressJobId, progressCtx)\n    } catch (error) {\n      const job = await progressService.getJob(run.progressJobId, progressCtx)\n      const cancelRequested = job && (job.status === 'running' || job.status === 'cancelled')\n        ? await progressService.isCancellationRequested(run.progressJobId, progressCtx.tenantId, progressCtx.organizationId)\n        : false\n\n      if (job?.status !== 'cancelled' && !cancelRequested) {\n        throw error\n      }\n    }\n  }\n\n  await syncRunService.markStatus(run.id, 'cancelled', scope)\n  await integrationStateService.upsert(run.integrationId, {\n    lastHealthStatus: 'degraded',\n    lastHealthCheckedAt: new Date(),\n  }, scope)\n  await integrationLogService.write({\n    integrationId: run.integrationId,\n    runId: run.id,\n    level: 'warn',\n    message: 'Sync run cancelled',\n    payload: {\n      operationalStatus: 'cancelled',\n      summary: 'The sync run was cancelled before completion.',\n    },\n  }, scope)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAKvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AACvE,QAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,IAAI,WAAW,aAAa,IAAI,WAAW,WAAW;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,gDAAgD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc;AAAA,IAClB,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf;AAEA,MAAI,IAAI,eAAe;AACrB,QAAI;AACF,YAAM,gBAAgB,cAAc,IAAI,eAAe,WAAW;AAAA,IACpE,SAAS,OAAO;AACd,YAAM,MAAM,MAAM,gBAAgB,OAAO,IAAI,eAAe,WAAW;AACvE,YAAM,kBAAkB,QAAQ,IAAI,WAAW,aAAa,IAAI,WAAW,eACvE,MAAM,gBAAgB,wBAAwB,IAAI,eAAe,YAAY,UAAU,YAAY,cAAc,IACjH;AAEJ,UAAI,KAAK,WAAW,eAAe,CAAC,iBAAiB;AACnD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,IAAI,IAAI,aAAa,KAAK;AAC1D,QAAM,wBAAwB,OAAO,IAAI,eAAe;AAAA,IACtD,kBAAkB;AAAA,IAClB,qBAAqB,oBAAI,KAAK;AAAA,EAChC,GAAG,KAAK;AACR,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,IAAI;AAAA,IACnB,OAAO,IAAI;AAAA,IACX,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS;AAAA,MACP,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF,GAAG,KAAK;AAER,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/retry.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { retrySyncSchema } from "../../../data/validators.js";
@@ -19,9 +20,13 @@ const openApi = {
 };
 async function POST(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -35,7 +40,7 @@ async function POST(req, ctx) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const progressService = container.resolve("progressService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const previous = await syncRunService.getRun(parsedParams.data.id, scope);
   if (!previous) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });

package/dist/modules/data_sync/api/runs/[id]/retry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/retry.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport { retrySyncSchema } from '../../../data/validators'\nimport { startDataSyncRun } from '../../../lib/start-run'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Retry a failed sync run',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsedBody = retrySyncSchema.safeParse(payload ?? {})\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const previous = await syncRunService.getRun(parsedParams.data.id, scope)\n  if (!previous) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (previous.status !== 'failed' && previous.status !== 'cancelled') {\n    return NextResponse.json({ error: 'Only failed or cancelled runs can be retried' }, { status: 409 })\n  }\n\n  const overlap = await syncRunService.findRunningOverlap(\n    previous.integrationId,\n    previous.entityType,\n    previous.direction,\n    scope,\n  )\n  if (overlap) {\n    return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: previous.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'retry', ...parsedBody.data },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const cursor = parsedBody.data.fromBeginning\n    ? null\n    : previous.cursor ?? await syncRunService.resolveCursor(previous.integrationId, previous.entityType, previous.direction, scope)\n\n  const { run, progressJob } = await startDataSyncRun({\n    syncRunService,\n    progressService,\n    scope: {\n      ...scope,\n      userId: auth.sub,\n    },\n    input: {\n      integrationId: previous.integrationId,\n      entityType: previous.entityType,\n      direction: previous.direction,\n      cursor,\n      triggeredBy: auth.sub,\n      batchSize: 100,\n      progressJob: {\n        name: `Retry data sync ${previous.integrationId} \u2014 ${previous.entityType}`,\n      },\n    },\n  })\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAG7B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,aAAa,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,WAAW,MAAM,eAAe,OAAO,aAAa,KAAK,IAAI,KAAK;AACxE,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,SAAS,WAAW,YAAY,SAAS,WAAW,aAAa;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpI;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS,GAAG,WAAW,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,WAAW,KAAK,gBAC3B,OACA,SAAS,UAAU,MAAM,eAAe,cAAc,SAAS,eAAe,SAAS,YAAY,SAAS,WAAW,KAAK;AAEhI,QAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,IAClD;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,aAAa;AAAA,QACX,MAAM,mBAAmB,SAAS,aAAa,WAAM,SAAS,UAAU;AAAA,MAC1E;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClG;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport { retrySyncSchema } from '../../../data/validators'\nimport { startDataSyncRun } from '../../../lib/start-run'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Retry a failed sync run',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsedBody = retrySyncSchema.safeParse(payload ?? {})\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const previous = await syncRunService.getRun(parsedParams.data.id, scope)\n  if (!previous) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (previous.status !== 'failed' && previous.status !== 'cancelled') {\n    return NextResponse.json({ error: 'Only failed or cancelled runs can be retried' }, { status: 409 })\n  }\n\n  const overlap = await syncRunService.findRunningOverlap(\n    previous.integrationId,\n    previous.entityType,\n    previous.direction,\n    scope,\n  )\n  if (overlap) {\n    return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: previous.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'retry', ...parsedBody.data },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const cursor = parsedBody.data.fromBeginning\n    ? null\n    : previous.cursor ?? await syncRunService.resolveCursor(previous.integrationId, previous.entityType, previous.direction, scope)\n\n  const { run, progressJob } = await startDataSyncRun({\n    syncRunService,\n    progressService,\n    scope: {\n      ...scope,\n      userId: auth.sub,\n    },\n    input: {\n      integrationId: previous.integrationId,\n      entityType: previous.entityType,\n      direction: previous.direction,\n      cursor,\n      triggeredBy: auth.sub,\n      batchSize: 100,\n      progressJob: {\n        name: `Retry data sync ${previous.integrationId} \u2014 ${previous.entityType}`,\n      },\n    },\n  })\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAG7B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,aAAa,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,WAAW,MAAM,eAAe,OAAO,aAAa,KAAK,IAAI,KAAK;AACxE,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,SAAS,WAAW,YAAY,SAAS,WAAW,aAAa;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpI;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS,GAAG,WAAW,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,WAAW,KAAK,gBAC3B,OACA,SAAS,UAAU,MAAM,eAAe,cAAc,SAAS,eAAe,SAAS,YAAY,SAAS,WAAW,KAAK;AAEhI,QAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,IAClD;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,aAAa;AAAA,QACX,MAAM,mBAAmB,SAAS,aAAa,WAAM,SAAS,UAAU;AAAA,MAC1E;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClG;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 const paramsSchema = z.object({ id: z.string().uuid() });
 const metadata = {
@@ -12,9 +13,13 @@ const openApi = {
 };
 async function GET(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsed = paramsSchema.safeParse(rawParams);
   if (!parsed.success) {
@@ -23,14 +28,14 @@ async function GET(req, ctx) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const progressService = container.resolve("progressService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const run = await syncRunService.getRun(parsed.data.id, scope);
   if (!run) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });
   }
   const progressJob = run.progressJobId ? await progressService.getJob(run.progressJobId, {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     userId: auth.sub
   }) : null;
   return NextResponse.json({

package/dist/modules/data_sync/api/runs/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get sync run detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n\n  const progressJob = run.progressJobId\n    ? await progressService.getJob(run.progressJobId, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n    })\n    : null\n\n  return NextResponse.json({\n    id: run.id,\n    integrationId: run.integrationId,\n    entityType: run.entityType,\n    direction: run.direction,\n    status: run.status,\n    cursor: run.cursor ?? null,\n    initialCursor: run.initialCursor ?? null,\n    createdCount: run.createdCount,\n    updatedCount: run.updatedCount,\n    skippedCount: run.skippedCount,\n    failedCount: run.failedCount,\n    batchesCompleted: run.batchesCompleted,\n    lastError: run.lastError ?? null,\n    progressJobId: run.progressJobId ?? null,\n    progressJob: progressJob\n      ? {\n        id: progressJob.id,\n        status: progressJob.status,\n        progressPercent: progressJob.progressPercent,\n        processedCount: progressJob.processedCount,\n        totalCount: progressJob.totalCount ?? null,\n        etaSeconds: progressJob.etaSeconds ?? null,\n      }\n      : null,\n    triggeredBy: run.triggeredBy ?? null,\n    createdAt: run.createdAt.toISOString(),\n    updatedAt: run.updatedAt.toISOString(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAIvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,cAAc,IAAI,gBACpB,MAAM,gBAAgB,OAAO,IAAI,eAAe;AAAA,IAChD,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC,IACC;AAEJ,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,UAAU;AAAA,IACtB,eAAe,IAAI,iBAAiB;AAAA,IACpC,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,aAAa,IAAI;AAAA,IACjB,kBAAkB,IAAI;AAAA,IACtB,WAAW,IAAI,aAAa;AAAA,IAC5B,eAAe,IAAI,iBAAiB;AAAA,IACpC,aAAa,cACT;AAAA,MACA,IAAI,YAAY;AAAA,MAChB,QAAQ,YAAY;AAAA,MACpB,iBAAiB,YAAY;AAAA,MAC7B,gBAAgB,YAAY;AAAA,MAC5B,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,YAAY,cAAc;AAAA,IACxC,IACE;AAAA,IACJ,aAAa,IAAI,eAAe;AAAA,IAChC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get sync run detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n\n  const progressJob = run.progressJobId\n    ? await progressService.getJob(run.progressJobId, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub,\n    })\n    : null\n\n  return NextResponse.json({\n    id: run.id,\n    integrationId: run.integrationId,\n    entityType: run.entityType,\n    direction: run.direction,\n    status: run.status,\n    cursor: run.cursor ?? null,\n    initialCursor: run.initialCursor ?? null,\n    createdCount: run.createdCount,\n    updatedCount: run.updatedCount,\n    skippedCount: run.skippedCount,\n    failedCount: run.failedCount,\n    batchesCompleted: run.batchesCompleted,\n    lastError: run.lastError ?? null,\n    progressJobId: run.progressJobId ?? null,\n    progressJob: progressJob\n      ? {\n        id: progressJob.id,\n        status: progressJob.status,\n        progressPercent: progressJob.progressPercent,\n        processedCount: progressJob.processedCount,\n        totalCount: progressJob.totalCount ?? null,\n        etaSeconds: progressJob.etaSeconds ?? null,\n      }\n      : null,\n    triggeredBy: run.triggeredBy ?? null,\n    createdAt: run.createdAt.toISOString(),\n    updatedAt: run.updatedAt.toISOString(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAIvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,cAAc,IAAI,gBACpB,MAAM,gBAAgB,OAAO,IAAI,eAAe;AAAA,IAChD,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,IACC;AAEJ,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,UAAU;AAAA,IACtB,eAAe,IAAI,iBAAiB;AAAA,IACpC,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,aAAa,IAAI;AAAA,IACjB,kBAAkB,IAAI;AAAA,IACtB,WAAW,IAAI,aAAa;AAAA,IAC5B,eAAe,IAAI,iBAAiB;AAAA,IACpC,aAAa,cACT;AAAA,MACA,IAAI,YAAY;AAAA,MAChB,QAAQ,YAAY;AAAA,MACpB,iBAAiB,YAAY;AAAA,MAC7B,gBAAgB,YAAY;AAAA,MAC5B,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,YAAY,cAAc;AAAA,IACxC,IACE;AAAA,IACJ,aAAa,IAAI,eAAe;AAAA,IAChC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/runs.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { listSyncRunsQuerySchema } from "../data/validators.js";
 const metadata = {
@@ -11,9 +12,13 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const url = new URL(req.url);
   const parsed = listSyncRunsQuerySchema.safeParse({
     integrationId: url.searchParams.get("integrationId") ?? void 0,
@@ -30,7 +35,7 @@ async function GET(req) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const { items, total } = await syncRunService.listRuns(parsed.data, {
-    organizationId: auth.orgId,
+    organizationId,
     tenantId: auth.tenantId
   });
   return NextResponse.json({

package/dist/modules/data_sync/api/runs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/runs.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { listSyncRunsQuerySchema } from '../data/validators'\nimport type { SyncRunService } from '../lib/sync-run-service'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List sync runs',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncRunsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n\n  const { items, total } = await syncRunService.listRuns(parsed.data, {\n    organizationId: auth.orgId as string,\n    tenantId: auth.tenantId,\n  })\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      direction: item.direction,\n      status: item.status,\n      cursor: item.cursor ?? null,\n      initialCursor: item.initialCursor ?? null,\n      createdCount: item.createdCount,\n      updatedCount: item.updatedCount,\n      skippedCount: item.skippedCount,\n      failedCount: item.failedCount,\n      batchesCompleted: item.batchesCompleted,\n      lastError: item.lastError ?? null,\n      progressJobId: item.progressJobId ?? null,\n      triggeredBy: item.triggeredBy ?? null,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAE7D,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,eAAe,SAAS,OAAO,MAAM;AAAA,IAClE,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,WAAW,KAAK,aAAa;AAAA,MAC7B,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { listSyncRunsQuerySchema } from '../data/validators'\nimport type { SyncRunService } from '../lib/sync-run-service'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List sync runs',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncRunsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n\n  const { items, total } = await syncRunService.listRuns(parsed.data, {\n    organizationId,\n    tenantId: auth.tenantId,\n  })\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      direction: item.direction,\n      status: item.status,\n      cursor: item.cursor ?? null,\n      initialCursor: item.initialCursor ?? null,\n      createdCount: item.createdCount,\n      updatedCount: item.updatedCount,\n      skippedCount: item.skippedCount,\n      failedCount: item.failedCount,\n      batchesCompleted: item.batchesCompleted,\n      lastError: item.lastError ?? null,\n      progressJobId: item.progressJobId ?? null,\n      triggeredBy: item.triggeredBy ?? null,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAE7D,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,eAAe,SAAS,OAAO,MAAM;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,WAAW,KAAK,aAAa;AAAA,MAC7B,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/schedules/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { readOptimisticLockExpected } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
@@ -25,9 +26,13 @@ const openApi = {
 };
 async function GET(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -36,7 +41,7 @@ async function GET(req, ctx) {
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
   const schedule = await scheduleService.getById(parsedParams.data.id, {
-    organizationId: auth.orgId,
+    organizationId,
     tenantId: auth.tenantId
   });
   if (!schedule) {
@@ -46,9 +51,13 @@ async function GET(req, ctx) {
 }
 async function PUT(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -61,7 +70,7 @@ async function PUT(req, ctx) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const current = await scheduleService.getById(parsedParams.data.id, scope);
   if (!current) {
     return NextResponse.json({ error: "Schedule not found" }, { status: 404 });
@@ -117,9 +126,13 @@ async function PUT(req, ctx) {
 }
 async function DELETE(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -127,7 +140,7 @@ async function DELETE(req, ctx) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId: scope.organizationId,