@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/dist/modules/entities/api/records.js

@@ -9,9 +9,30 @@ import { parseBooleanToken, parseBooleanWithDefault } from "@open-mercato/shared
 import { parseCommaSeparatedList } from "@open-mercato/shared/lib/string";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
-import { assertEntityAclForRequest, getDeclaredCustomEntityRestriction } from "../lib/entityAcl.js";
+import { getModules } from "@open-mercato/shared/lib/i18n/server";
+import { assertEntityAclForRequest } from "../lib/entityAcl.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("entities").child({ component: "records" });
+let declaredCustomEntityRestricted = null;
+function loadDeclaredCustomEntities() {
+  if (declaredCustomEntityRestricted === null) {
+    try {
+      const mods = getModules();
+      const map = /* @__PURE__ */ new Map();
+      for (const mod of mods ?? []) {
+        for (const spec of mod?.customEntities ?? []) {
+          if (spec?.id) map.set(spec.id, spec.accessRestricted === true);
+        }
+      }
+      declaredCustomEntityRestricted = map;
+    } catch {
+    }
+  }
+  return declaredCustomEntityRestricted ?? /* @__PURE__ */ new Map();
+}
+function isDeclaredCustomEntity(entityId) {
+  return loadDeclaredCustomEntities().has(entityId);
+}
 async function findScopedCustomEntity(em, CustomEntity, entityId, scope) {
   const { tenantId, organizationId } = scope;
   const candidates = [
@@ -32,8 +53,8 @@ async function findScopedCustomEntity(em, CustomEntity, entityId, scope) {
 const CUSTOM_ENTITY_RECORD_RESOURCE_KIND = "entities.record";
 async function classifyRecordsEntity(em, entityId, scope) {
   if (isOrmBackedSystemEntityId(em, entityId)) return { kind: "system", restricted: false };
-  const declaredRestriction = getDeclaredCustomEntityRestriction(entityId);
-  if (declaredRestriction !== void 0) return { kind: "custom", restricted: declaredRestriction };
+  const declared = loadDeclaredCustomEntities();
+  if (declared.has(entityId)) return { kind: "custom", restricted: declared.get(entityId) === true };
   try {
     const { CustomEntity } = await import("../data/entities.js");
     const scoped = await findScopedCustomEntity(em, CustomEntity, entityId, scope);

package/dist/modules/entities/api/records.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/records.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { QueryEngine, QueryOptions, Where, Sort } from '@open-mercato/shared/lib/query/types'\nimport { normalizeExportFormat, serializeExport, defaultExportFilename, ensureColumns } from '@open-mercato/shared/lib/crud/exporters'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'\nimport { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport { setRecordCustomFields } from '../lib/helpers'\nimport { CustomFieldValue } from '../data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { assertEntityAclForRequest, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('entities').child({ component: 'records' })\n\ntype RecordsEntityScope = { tenantId: string | null; organizationId: string | null }\n\n// Resolve the CustomEntity registration that applies to THIS caller, most-specific\n// first (org+tenant \u2192 tenant-global \u2192 instance-global), mirroring the overlay\n// precedence used by the entity-definitions list. Scoping matters because the\n// row's `access_restricted` flag is a security control: an unscoped lookup could\n// read another tenant's row for a colliding entityId (e.g. `user:vendors`) and\n// mis-decide the restriction. Returns null when the caller's scope has no row.\nasync function findScopedCustomEntity(em: any, CustomEntity: any, entityId: string, scope: RecordsEntityScope) {\n  const { tenantId, organizationId } = scope\n  const candidates: Array<Record<string, unknown>> = [\n    { entityId, organizationId, tenantId },\n    { entityId, organizationId: null, tenantId },\n    { entityId, organizationId: null, tenantId: null },\n  ]\n  const seen = new Set<string>()\n  for (const where of candidates) {\n    const key = JSON.stringify(where)\n    if (seen.has(key)) continue\n    seen.add(key)\n    const row = await em.findOne(CustomEntity as any, where)\n    if (row) return row\n  }\n  return null\n}\n\nconst CUSTOM_ENTITY_RECORD_RESOURCE_KIND = 'entities.record'\n\ntype RecordsEntityKind = 'system' | 'custom' | 'unknown'\n\n// `restricted` is meaningful only when `kind === 'custom'`; it drives the\n// per-entity ACL gate in `assertEntityAclForRequest`.\ntype RecordsEntityClassification = { kind: RecordsEntityKind; restricted: boolean }\n\n// This surface manages doc-storage records, which exist for CUSTOM entities only.\n// Module-declared ids backed by a registered ORM table are system entities \u2014 their\n// records live in their own module tables/APIs, and stray doc rows for them poisoned\n// read-path classification platform-wide (#2939) \u2014 so they are rejected outright. The\n// previous fallback that classified an entity by the mere presence of\n// `custom_entities_storage` rows is gone: within the allowed set, declaration (ce.ts)\n// or an active `custom_entities` registration is authoritative.\nasync function classifyRecordsEntity(em: any, entityId: string, scope: RecordsEntityScope): Promise<RecordsEntityClassification> {\n  if (isOrmBackedSystemEntityId(em, entityId)) return { kind: 'system', restricted: false }\n  const declaredRestriction = getDeclaredCustomEntityRestriction(entityId)\n  if (declaredRestriction !== undefined) return { kind: 'custom', restricted: declaredRestriction }\n  try {\n    const { CustomEntity } = await import('../data/entities')\n    // Restriction is decided from the row that applies to THIS caller's scope so\n    // a colliding entityId in another tenant can't flip the flag.\n    const scoped = await findScopedCustomEntity(em, CustomEntity, entityId, scope)\n    if (scoped) return { kind: 'custom', restricted: (scoped as any).accessRestricted === true }\n    // No in-scope registration: preserve the historical custom-vs-unknown\n    // classification (any registration row \u2014 active or soft-deleted \u2014 proves the\n    // id is custom; records persist beyond soft delete, TC-ENTITIES-006). A row\n    // outside the caller's scope never marks the entity restricted for them, and\n    // the record query is itself tenant/org-scoped, so this cannot leak data.\n    const anyRow = await em.findOne(CustomEntity as any, { entityId })\n    if (anyRow) return { kind: 'custom', restricted: false }\n  } catch {}\n  return { kind: 'unknown', restricted: false }\n}\n\nfunction systemEntityRecordsRejection(entityId: string) {\n  return NextResponse.json(\n    { error: 'Records are available for custom entities only', code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, entityId },\n    { status: 400 },\n  )\n}\n\nasync function readCustomEntityRecordUpdatedAt(\n  em: any,\n  input: { entityType: string; entityId: string; organizationId: string | null },\n): Promise<string | null> {\n  try {\n    const db = em.getKysely()\n    let query = db\n      .selectFrom('custom_entities_storage' as any)\n      .select(['updated_at' as any])\n      .where('entity_type' as any, '=', input.entityType)\n      .where('entity_id' as any, '=', input.entityId)\n    query = input.organizationId === null\n      ? query.where('organization_id' as any, 'is', null as any)\n      : query.where('organization_id' as any, '=', input.organizationId)\n    const row = await query.executeTakeFirst()\n    const value = (row as any)?.updated_at\n    if (value instanceof Date) return value.toISOString()\n    if (typeof value === 'string' && value.length > 0) return value\n    return null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n}\n\nconst DEFAULT_EXPORT_PAGE_SIZE = 1000\n\nconst listRecordsQuerySchema = z\n  .object({\n    entityId: z.string().min(1),\n    page: z.coerce.number().int().min(1).optional(),\n    pageSize: z.coerce.number().int().min(1).max(100).optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n    search: z.string().optional(),\n    searchFields: z.string().optional(),\n    withDeleted: z.coerce.boolean().optional(),\n    format: z.enum(['csv', 'json', 'xml', 'markdown']).optional(),\n    exportScope: z.enum(['full']).optional(),\n    export_scope: z.enum(['full']).optional(),\n    all: z.coerce.boolean().optional(),\n    full: z.coerce.boolean().optional(),\n  })\n  .passthrough()\n\nconst recordItemSchema = z.record(z.string(), z.any())\n\nconst listRecordsResponseSchema = z.object({\n  items: z.array(recordItemSchema),\n  total: z.number(),\n  page: z.number(),\n  pageSize: z.number(),\n  totalPages: z.number(),\n})\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const requestedExport = normalizeExportFormat(url.searchParams.get('format'))\n  const exportScopeRaw = (url.searchParams.get('exportScope') || url.searchParams.get('export_scope') || '').toLowerCase()\n  const exportFullRequested = requestedExport != null && (exportScopeRaw === 'full' || parseBooleanWithDefault(url.searchParams.get('full'), false))\n  const exportAll = parseBooleanWithDefault(url.searchParams.get('all'), false)\n  const noPagination = exportAll || requestedExport != null\n  const page = noPagination ? 1 : Math.max(parseInt(url.searchParams.get('page') || '1', 10) || 1, 1)\n  const basePageSize = Math.min(Math.max(parseInt(url.searchParams.get('pageSize') || '50', 10) || 50, 1), 100)\n  const pageSize = noPagination ? Math.max(basePageSize, DEFAULT_EXPORT_PAGE_SIZE) : basePageSize\n  const sortField = url.searchParams.get('sortField') || 'id'\n  const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'\n  const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)\n  const searchTerm = (url.searchParams.get('search') || '').trim()\n  const searchFields = parseCommaSeparatedList(url.searchParams.get('searchFields'))\n\n  const qpEntries: Array<[string, string]> = []\n  for (const [key, val] of url.searchParams.entries()) {\n    if (['entityId','page','pageSize','sortField','sortDir','withDeleted','format','exportScope','export_scope','all','full','search','searchFields'].includes(key)) continue\n    qpEntries.push([key, val])\n  }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const qe = resolve('queryEngine') as QueryEngine\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    let organizationIds: string[] | null = scope.filterIds\n    // Module-declared custom entities (ce.ts) carry frozen system-style ids and are never\n    // registered in `custom_entities`, so classification checks the declared registry plus\n    // active registrations. System (table-backed) ids are rejected above; for the allowed\n    // set `isCustomEntity` drives mapRow's cf_ stripping so the edit form reads back values.\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'view', isCustomEntity, isRestricted, rbac })\n    if (organizationIds && organizationIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n    }\n    const normalizeCustomEntityValue = (value: unknown) => {\n      if (Array.isArray(value)) {\n        return value.map((entry) => {\n          if (typeof entry !== 'string') return entry\n          const parsed = parseBooleanToken(entry)\n          return parsed === null ? entry : parsed\n        })\n      }\n      if (typeof value !== 'string') return value\n      const parsed = parseBooleanToken(value)\n      return parsed === null ? value : parsed\n    }\n    const mapRow = (row: any) => {\n      if (!isCustomEntity || !row || typeof row !== 'object') return row\n      const out: Record<string, unknown> = {}\n      for (const [k, v] of Object.entries(row)) {\n        if (k.startsWith('cf_')) out[k.replace(/^cf_/, '')] = normalizeCustomEntityValue(v)\n        else out[k] = v\n      }\n      return out\n    }\n    const mapFullRow = (row: any) => {\n      if (!row || typeof row !== 'object') return row\n      return { ...(row as Record<string, unknown>) }\n    }\n    // Build filters with awareness of custom-entity mode\n    const filtersObj: Where<any> = {}\n    const buildFilter = (key: string, val: string, allowAnyKey: boolean) => {\n      if (key.startsWith('cf_')) {\n        if (key.endsWith('In')) {\n          const base = key.slice(0, -2)\n          const values = parseCommaSeparatedList(val)\n          ;(filtersObj as any)[base] = { $in: values }\n        } else {\n          if (val.includes(',')) {\n            const values = parseCommaSeparatedList(val)\n            ;(filtersObj as any)[key] = { $in: values }\n          } else {\n            const parsed = parseBooleanToken(val)\n            ;(filtersObj as any)[key] = parsed === null ? val : parsed\n          }\n        }\n      } else if (allowAnyKey) {\n        if (val.includes(',')) {\n          const values = parseCommaSeparatedList(val)\n          ;(filtersObj as any)[key] = { $in: values }\n        } else {\n          const parsed = parseBooleanToken(val)\n          ;(filtersObj as any)[key] = parsed === null ? val : parsed\n        }\n      } else {\n        if (['id', 'created_at', 'updated_at', 'deleted_at', 'name', 'title', 'email'].includes(key)) {\n          ;(filtersObj as any)[key] = val\n        }\n      }\n    }\n\n    if (organizationIds && organizationIds.length) {\n      (filtersObj as any).organization_id = { $in: organizationIds }\n    }\n    const qopts: QueryOptions = {\n      tenantId: auth.tenantId!,\n      includeCustomFields: true,\n      page: { page, pageSize },\n      sort: [{ field: sortField as any, dir: sortDir as any }] as Sort[],\n      filters: filtersObj as any,\n      withDeleted,\n    }\n    if (organizationIds && organizationIds.length) {\n      qopts.organizationIds = organizationIds\n    }\n    // Allowed entities are doc-storage-backed by definition (system ids were rejected\n    // above) \u2014 direct the engine to doc storage explicitly so reads stay deterministic\n    // even before the first record exists.\n    if (isCustomEntity) qopts.forceCustomEntityStorage = true\n    for (const [k, v] of qpEntries) buildFilter(k, v, isCustomEntity)\n    // Server-side full-result search: match the term against the requested fields\n    // (defaults to `id`) before pagination so totals/exports stay consistent with\n    // the active search instead of filtering only the current client page (#3229).\n    if (searchTerm) {\n      const fields = searchFields.length ? searchFields : ['id']\n      const pattern = `%${searchTerm}%`\n      const orClauses = fields.map((field) => ({ [field]: { $ilike: pattern } }))\n      ;(filtersObj as any).$or = orClauses\n    }\n    const res = await qe.query(entityId as any, qopts)\n    const rawItems = res.items || []\n    const viewPageItems = rawItems.map(mapRow)\n    const fullPageItems = rawItems.map(mapFullRow)\n\n    // Expose `updated_at` on custom-entity records. The query engine returns only\n    // the `doc` fields + `id`, dropping the base `updated_at` column \u2014 which made\n    // optimistic locking impossible end-to-end (no version for the edit page to\n    // round-trip as the lock header). Batch-read it from storage and merge it in.\n    if (isCustomEntity && viewPageItems.length) {\n      try {\n        const recordIds = viewPageItems\n          .map((it: any) => it?.id)\n          .filter((v: any): v is string => typeof v === 'string' && v.length > 0)\n        if (recordIds.length) {\n          const db = em.getKysely()\n          const rows = await db\n            .selectFrom('custom_entities_storage' as any)\n            .select(['entity_id' as any, 'updated_at' as any])\n            .where('entity_type' as any, '=', entityId)\n            .where('entity_id' as any, 'in', recordIds as any)\n            .execute()\n          const updatedById = new Map<string, string>()\n          for (const row of rows as any[]) {\n            const value = row?.updated_at\n            const iso = value instanceof Date ? value.toISOString() : (typeof value === 'string' && value.length > 0 ? value : null)\n            if (iso && row?.entity_id) updatedById.set(String(row.entity_id), iso)\n          }\n          for (const item of viewPageItems as any[]) {\n            const iso = updatedById.get(String(item?.id))\n            if (iso) {\n              item.updated_at = iso\n              item.updatedAt = iso\n            }\n          }\n        }\n      } catch { /* best-effort: locking simply will not engage if storage is unavailable */ }\n    }\n\n    const total = typeof res.total === 'number' ? res.total : rawItems.length\n    const effectivePageSize = res.pageSize || pageSize\n    const payload = {\n      items: viewPageItems,\n      total,\n      page: res.page || page,\n      pageSize: effectivePageSize,\n      totalPages: Math.ceil(total / (effectivePageSize || 1)),\n    }\n\n    if (requestedExport) {\n      let exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]\n      if (total > exportItems.length) {\n        let nextPage = 2\n        while (exportItems.length < total) {\n          const nextRes = await qe.query(entityId as any, {\n            ...qopts,\n            page: { page: nextPage, pageSize },\n          })\n          const nextRawItems = nextRes.items || []\n          if (!nextRawItems.length) break\n          const nextViewItems = nextRawItems.map(mapRow)\n          const nextFullItems = nextRawItems.map(mapFullRow)\n          const nextBatch = exportFullRequested ? nextFullItems : nextViewItems\n          exportItems.push(...nextBatch)\n          if (nextBatch.length < pageSize) break\n          nextPage += 1\n        }\n      }\n      const prepared = {\n        columns: ensureColumns(exportItems),\n        rows: exportItems,\n      }\n      const filenameBase = exportFullRequested ? `${entityId || 'records'}_full` : entityId || 'records'\n      const serialized = serializeExport(prepared, requestedExport)\n      const filename = defaultExportFilename(filenameBase, requestedExport)\n      return new Response(serialized.body, {\n        headers: {\n          'content-type': serialized.contentType,\n          'content-disposition': `attachment; filename=\"${filename}\"`,\n        },\n      })\n    }\n\n    return NextResponse.json(payload)\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    logger.error('Records GET failed', { err: e })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst postBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1).optional(),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst putBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst mutationResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z\n    .object({\n      entityId: z.string(),\n      recordId: z.string(),\n    })\n    .optional(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: unknown\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = postBodySchema.safeParse(json)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId } = parsed.data\n  let { recordId, values } = parsed.data as { recordId?: string; values: Record<string, any> }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n    // Strip reserved record/system columns the edit form echoes back from the loaded record\n    // (`id`, plus `updated_at`/`updatedAt` used for optimistic locking). They are not custom\n    // fields; without this they validate as cf_id / cf_updated_at / cf_updatedAt and are\n    // rejected as \"Unknown custom field\", which fails EVERY custom-entity edit-form save.\n    for (const reservedKey of ['id', 'created_at', 'createdAt', 'updated_at', 'updatedAt', 'deleted_at', 'deletedAt']) {\n      delete (values as any)[reservedKey]\n    }\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    const normalizedRecordId = (() => {\n      const raw = String(recordId || '').trim()\n      if (!raw) return undefined\n      const low = raw.toLowerCase()\n      if (low === 'create' || low === 'new' || low === 'null' || low === 'undefined') return undefined\n      // Enforce UUID only; any non-uuid is ignored so we generate one in the DE\n      const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n      return uuid.test(raw) ? raw : undefined\n    })()\n    const { id } = await de.createCustomEntityRecord({\n      entityId,\n      recordId: normalizedRecordId,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n\n    return NextResponse.json({ ok: true, item: { entityId, recordId: id } })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    logger.error('Records POST failed', { err: e })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\n// Avoid zod here to prevent runtime import issues in some environments\nfunction parsePutBody(json: any): { ok: true; data: { entityId: string; recordId: string; values: Record<string, any> } } | { ok: false; error: string } {\n  if (!json || typeof json !== 'object') return { ok: false, error: 'Invalid JSON' }\n  const entityId = typeof json.entityId === 'string' && json.entityId.length ? json.entityId : ''\n  const recordId = typeof json.recordId === 'string' && json.recordId.length ? json.recordId : ''\n  const values = (json.values && typeof json.values === 'object') ? json.values as Record<string, any> : {}\n  if (!entityId || !recordId) return { ok: false, error: 'entityId and recordId are required' }\n  return { ok: true, data: { entityId, recordId, values } }\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: any\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = parsePutBody(json)\n  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })\n  const { entityId, recordId, values } = parsed.data\n\n  try {\n    const container = await createRequestContainer()\n    const { resolve } = container\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n    // Strip reserved record/system columns the edit form echoes back from the loaded record\n    // (`id`, plus `updated_at`/`updatedAt` used for optimistic locking). They are not custom\n    // fields; without this they validate as cf_id / cf_updated_at / cf_updatedAt and are\n    // rejected as \"Unknown custom field\", which fails EVERY custom-entity edit-form save.\n    for (const reservedKey of ['id', 'created_at', 'createdAt', 'updated_at', 'updatedAt', 'deleted_at', 'deletedAt']) {\n      delete (values as any)[reservedKey]\n    }\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    // Normalize recordId: if blank/sentinel/non-uuid => create instead of update\n    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n    const rid = String(recordId || '').trim()\n    const low = rid.toLowerCase()\n    const isSentinel = !rid || low === 'create' || low === 'new' || low === 'null' || low === 'undefined'\n    const isUuid = uuidRe.test(rid)\n    if (isSentinel || !isUuid) {\n      const created = await de.createCustomEntityRecord({\n        entityId,\n        recordId: undefined,\n        organizationId: targetOrgId,\n        tenantId: auth.tenantId!,\n        values: norm,\n      })\n      return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })\n    }\n\n    try {\n      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {\n        entityType: entityId,\n        entityId: rid,\n        organizationId: targetOrgId,\n      })\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,\n        resourceId: rid,\n        current: currentUpdatedAt,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    await de.updateCustomEntityRecord({\n      entityId,\n      recordId: rid,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n    return NextResponse.json({ ok: true, item: { entityId, recordId: rid } })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst deleteBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n})\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const qpEntityId = url.searchParams.get('entityId')\n  const qpRecordId = url.searchParams.get('recordId')\n  let payload: any = qpEntityId && qpRecordId ? { entityId: qpEntityId, recordId: qpRecordId } : null\n  if (!payload) {\n    try { payload = await req.json() } catch { payload = null }\n  }\n  const parsed = deleteBodySchema.safeParse(payload)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId, recordId } = parsed.data\n\n  try {\n    const container = await createRequestContainer()\n    const { resolve } = container\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n\n    try {\n      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {\n        entityType: entityId,\n        entityId: recordId,\n        organizationId: targetOrgId,\n      })\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,\n        resourceId: recordId,\n        current: currentUpdatedAt,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    await de.deleteCustomEntityRecord({ entityId, recordId, organizationId: targetOrgId, tenantId: auth.tenantId!, soft: true })\n    return NextResponse.json({ ok: true })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nfunction normalizeValues(input: Record<string, any>): Record<string, any> {\n  const out: Record<string, any> = {}\n  for (const [k, v] of Object.entries(input || {})) {\n    const key = k.startsWith('cf_') ? k.replace(/^cf_/, '') : k\n    out[key] = v\n  }\n  return out\n}\n\nconst deleteResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n}).passthrough()\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'CRUD operations on entity records',\n  methods: {\n    GET: {\n      summary: 'List records',\n      description:\n        'Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles.',\n      query: listRecordsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated records',\n          schema: listRecordsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create record',\n      description:\n        'Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: postBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record created',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update record',\n      description:\n        'Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record updated',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete record',\n      description: 'Soft deletes the specified record within the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record deleted',\n          schema: deleteResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or record id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 404,\n          description: 'Record not found',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,iBAAiB,uBAAuB,qBAAqB;AAE7F,SAAS,0BAA0B,0CAA0C;AAC7E,SAAS,oCAAoC,iCAAiC;AAC9E,SAAS,mBAAmB,+BAA+B;AAC3D,SAAS,+BAA+B;AAIxC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,2BAA2B,0CAA0C;AAC9E,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAUtE,eAAe,uBAAuB,IAAS,cAAmB,UAAkB,OAA2B;AAC7G,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,QAAM,aAA6C;AAAA,IACjD,EAAE,UAAU,gBAAgB,SAAS;AAAA,IACrC,EAAE,UAAU,gBAAgB,MAAM,SAAS;AAAA,IAC3C,EAAE,UAAU,gBAAgB,MAAM,UAAU,KAAK;AAAA,EACnD;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,YAAY;AAC9B,UAAM,MAAM,KAAK,UAAU,KAAK;AAChC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAqB,KAAK;AACvD,QAAI,IAAK,QAAO;AAAA,EAClB;AACA,SAAO;AACT;AAEA,MAAM,qCAAqC;AAe3C,eAAe,sBAAsB,IAAS,UAAkB,OAAiE;AAC/H,MAAI,0BAA0B,IAAI,QAAQ,EAAG,QAAO,EAAE,MAAM,UAAU,YAAY,MAAM;AACxF,QAAM,sBAAsB,mCAAmC,QAAQ;AACvE,MAAI,wBAAwB,OAAW,QAAO,EAAE,MAAM,UAAU,YAAY,oBAAoB;AAChG,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AAGxD,UAAM,SAAS,MAAM,uBAAuB,IAAI,cAAc,UAAU,KAAK;AAC7E,QAAI,OAAQ,QAAO,EAAE,MAAM,UAAU,YAAa,OAAe,qBAAqB,KAAK;AAM3F,UAAM,SAAS,MAAM,GAAG,QAAQ,cAAqB,EAAE,SAAS,CAAC;AACjE,QAAI,OAAQ,QAAO,EAAE,MAAM,UAAU,YAAY,MAAM;AAAA,EACzD,QAAQ;AAAA,EAAC;AACT,SAAO,EAAE,MAAM,WAAW,YAAY,MAAM;AAC9C;AAEA,SAAS,6BAA6B,UAAkB;AACtD,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,kDAAkD,MAAM,oCAAoC,SAAS;AAAA,IAC9G,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,gCACb,IACA,OACwB;AACxB,MAAI;AACF,UAAM,KAAK,GAAG,UAAU;AACxB,QAAI,QAAQ,GACT,WAAW,yBAAgC,EAC3C,OAAO,CAAC,YAAmB,CAAC,EAC5B,MAAM,eAAsB,KAAK,MAAM,UAAU,EACjD,MAAM,aAAoB,KAAK,MAAM,QAAQ;AAChD,YAAQ,MAAM,mBAAmB,OAC7B,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,MAAM,cAAc;AACnE,UAAM,MAAM,MAAM,MAAM,iBAAiB;AACzC,UAAM,QAAS,KAAa;AAC5B,QAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACxE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA,EAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACxC,KAAK,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAEf,MAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAErD,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,kBAAkB,sBAAsB,IAAI,aAAa,IAAI,QAAQ,CAAC;AAC5E,QAAM,kBAAkB,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,aAAa,IAAI,cAAc,KAAK,IAAI,YAAY;AACvH,QAAM,sBAAsB,mBAAmB,SAAS,mBAAmB,UAAU,wBAAwB,IAAI,aAAa,IAAI,MAAM,GAAG,KAAK;AAChJ,QAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,KAAK,GAAG,KAAK;AAC5E,QAAM,eAAe,aAAa,mBAAmB;AACrD,QAAM,OAAO,eAAe,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,KAAK,GAAG,CAAC;AAClG,QAAM,eAAe,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AAC5G,QAAM,WAAW,eAAe,KAAK,IAAI,cAAc,wBAAwB,IAAI;AACnF,QAAM,YAAY,IAAI,aAAa,IAAI,WAAW,KAAK;AACvD,QAAM,WAAW,IAAI,aAAa,IAAI,SAAS,KAAK,OAAO,YAAY,MAAM,SAAS,SAAS;AAC/F,QAAM,cAAc,wBAAwB,IAAI,aAAa,IAAI,aAAa,GAAG,KAAK;AACtF,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ,KAAK,IAAI,KAAK;AAC/D,QAAM,eAAe,wBAAwB,IAAI,aAAa,IAAI,cAAc,CAAC;AAEjF,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,QAAQ,GAAG;AACnD,QAAI,CAAC,YAAW,QAAO,YAAW,aAAY,WAAU,eAAc,UAAS,eAAc,gBAAe,OAAM,QAAO,UAAS,cAAc,EAAE,SAAS,GAAG,EAAG;AACjK,cAAU,KAAK,CAAC,KAAK,GAAG,CAAC;AAAA,EAC3B;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,aAAa;AAChC,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,QAAI,kBAAmC,MAAM;AAK7C,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,QAAQ,gBAAgB,cAAc,KAAK,CAAC;AACtG,QAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,6BAA6B,CAAC,UAAmB;AACrD,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,IAAI,CAAC,UAAU;AAC1B,cAAI,OAAO,UAAU,SAAU,QAAO;AACtC,gBAAMA,UAAS,kBAAkB,KAAK;AACtC,iBAAOA,YAAW,OAAO,QAAQA;AAAA,QACnC,CAAC;AAAA,MACH;AACA,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,SAAS,kBAAkB,KAAK;AACtC,aAAO,WAAW,OAAO,QAAQ;AAAA,IACnC;AACA,UAAM,SAAS,CAAC,QAAa;AAC3B,UAAI,CAAC,kBAAkB,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC/D,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,EAAE,WAAW,KAAK,EAAG,KAAI,EAAE,QAAQ,QAAQ,EAAE,CAAC,IAAI,2BAA2B,CAAC;AAAA,YAC7E,KAAI,CAAC,IAAI;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAa;AAC/B,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,aAAO,EAAE,GAAI,IAAgC;AAAA,IAC/C;AAEA,UAAM,aAAyB,CAAC;AAChC,UAAM,cAAc,CAAC,KAAa,KAAa,gBAAyB;AACtE,UAAI,IAAI,WAAW,KAAK,GAAG;AACzB,YAAI,IAAI,SAAS,IAAI,GAAG;AACtB,gBAAM,OAAO,IAAI,MAAM,GAAG,EAAE;AAC5B,gBAAM,SAAS,wBAAwB,GAAG;AACzC,UAAC,WAAmB,IAAI,IAAI,EAAE,KAAK,OAAO;AAAA,QAC7C,OAAO;AACL,cAAI,IAAI,SAAS,GAAG,GAAG;AACrB,kBAAM,SAAS,wBAAwB,GAAG;AACzC,YAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,UAC5C,OAAO;AACL,kBAAM,SAAS,kBAAkB,GAAG;AACnC,YAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,UACtD;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,YAAI,IAAI,SAAS,GAAG,GAAG;AACrB,gBAAM,SAAS,wBAAwB,GAAG;AACzC,UAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,QAC5C,OAAO;AACL,gBAAM,SAAS,kBAAkB,GAAG;AACnC,UAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,QACtD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,cAAc,cAAc,cAAc,QAAQ,SAAS,OAAO,EAAE,SAAS,GAAG,GAAG;AAC5F;AAAC,UAAC,WAAmB,GAAG,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,MAAC,WAAmB,kBAAkB,EAAE,KAAK,gBAAgB;AAAA,IAC/D;AACA,UAAM,QAAsB;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,qBAAqB;AAAA,MACrB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,MAAM,CAAC,EAAE,OAAO,WAAkB,KAAK,QAAe,CAAC;AAAA,MACvD,SAAS;AAAA,MACT;AAAA,IACF;AACA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,YAAM,kBAAkB;AAAA,IAC1B;AAIA,QAAI,eAAgB,OAAM,2BAA2B;AACrD,eAAW,CAAC,GAAG,CAAC,KAAK,UAAW,aAAY,GAAG,GAAG,cAAc;AAIhE,QAAI,YAAY;AACd,YAAM,SAAS,aAAa,SAAS,eAAe,CAAC,IAAI;AACzD,YAAM,UAAU,IAAI,UAAU;AAC9B,YAAM,YAAY,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,GAAG,EAAE,QAAQ,QAAQ,EAAE,EAAE;AACzE,MAAC,WAAmB,MAAM;AAAA,IAC7B;AACA,UAAM,MAAM,MAAM,GAAG,MAAM,UAAiB,KAAK;AACjD,UAAM,WAAW,IAAI,SAAS,CAAC;AAC/B,UAAM,gBAAgB,SAAS,IAAI,MAAM;AACzC,UAAM,gBAAgB,SAAS,IAAI,UAAU;AAM7C,QAAI,kBAAkB,cAAc,QAAQ;AAC1C,UAAI;AACF,cAAM,YAAY,cACf,IAAI,CAAC,OAAY,IAAI,EAAE,EACvB,OAAO,CAAC,MAAwB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AACxE,YAAI,UAAU,QAAQ;AACpB,gBAAM,KAAK,GAAG,UAAU;AACxB,gBAAM,OAAO,MAAM,GAChB,WAAW,yBAAgC,EAC3C,OAAO,CAAC,aAAoB,YAAmB,CAAC,EAChD,MAAM,eAAsB,KAAK,QAAQ,EACzC,MAAM,aAAoB,MAAM,SAAgB,EAChD,QAAQ;AACX,gBAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAW,OAAO,MAAe;AAC/B,kBAAM,QAAQ,KAAK;AACnB,kBAAM,MAAM,iBAAiB,OAAO,MAAM,YAAY,IAAK,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACnH,gBAAI,OAAO,KAAK,UAAW,aAAY,IAAI,OAAO,IAAI,SAAS,GAAG,GAAG;AAAA,UACvE;AACA,qBAAW,QAAQ,eAAwB;AACzC,kBAAM,MAAM,YAAY,IAAI,OAAO,MAAM,EAAE,CAAC;AAC5C,gBAAI,KAAK;AACP,mBAAK,aAAa;AAClB,mBAAK,YAAY;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAA8E;AAAA,IACxF;AAEA,UAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,SAAS;AACnE,UAAM,oBAAoB,IAAI,YAAY;AAC1C,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,IAAI,QAAQ;AAAA,MAClB,UAAU;AAAA,MACV,YAAY,KAAK,KAAK,SAAS,qBAAqB,EAAE;AAAA,IACxD;AAEA,QAAI,iBAAiB;AACnB,UAAI,cAAqB,sBAAsB,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,aAAa;AACrF,UAAI,QAAQ,YAAY,QAAQ;AAC9B,YAAI,WAAW;AACf,eAAO,YAAY,SAAS,OAAO;AACjC,gBAAM,UAAU,MAAM,GAAG,MAAM,UAAiB;AAAA,YAC9C,GAAG;AAAA,YACH,MAAM,EAAE,MAAM,UAAU,SAAS;AAAA,UACnC,CAAC;AACD,gBAAM,eAAe,QAAQ,SAAS,CAAC;AACvC,cAAI,CAAC,aAAa,OAAQ;AAC1B,gBAAM,gBAAgB,aAAa,IAAI,MAAM;AAC7C,gBAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,gBAAM,YAAY,sBAAsB,gBAAgB;AACxD,sBAAY,KAAK,GAAG,SAAS;AAC7B,cAAI,UAAU,SAAS,SAAU;AACjC,sBAAY;AAAA,QACd;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,SAAS,cAAc,WAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,YAAM,eAAe,sBAAsB,GAAG,YAAY,SAAS,UAAU,YAAY;AACzF,YAAM,aAAa,gBAAgB,UAAU,eAAe;AAC5D,YAAM,WAAW,sBAAsB,cAAc,eAAe;AACpE,aAAO,IAAI,SAAS,WAAW,MAAM;AAAA,QACnC,SAAS;AAAA,UACP,gBAAgB,WAAW;AAAA,UAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,MAAM,sBAAsB,EAAE,KAAK,EAAE,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EACH,OAAO;AAAA,IACN,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO;AAAA,EACrB,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,EAAE,UAAU,OAAO,IAAI,OAAO;AAElC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAKxG,eAAW,eAAe,CAAC,MAAM,cAAc,aAAa,cAAc,aAAa,cAAc,WAAW,GAAG;AACjH,aAAQ,OAAe,WAAW;AAAA,IACpC;AACA,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAEzC,UAAM,sBAAsB,MAAM;AAChC,YAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,MAAM,IAAI,YAAY;AAC5B,UAAI,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ,YAAa,QAAO;AAEvF,YAAM,OAAO;AACb,aAAO,KAAK,KAAK,GAAG,IAAI,MAAM;AAAA,IAChC,GAAG;AACH,UAAM,EAAE,GAAG,IAAI,MAAM,GAAG,yBAAyB;AAAA,MAC/C;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,GAAG,EAAE,CAAC;AAAA,EACzE,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,MAAM,uBAAuB,EAAE,KAAK,EAAE,CAAC;AAC9C,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAGA,SAAS,aAAa,MAAmI;AACvJ,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,eAAe;AACjF,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,SAAU,KAAK,UAAU,OAAO,KAAK,WAAW,WAAY,KAAK,SAAgC,CAAC;AACxG,MAAI,CAAC,YAAY,CAAC,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,qCAAqC;AAC5F,SAAO,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,OAAO,EAAE;AAC1D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,aAAa,IAAI;AAChC,MAAI,CAAC,OAAO,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI,OAAO;AAE9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,EAAE,QAAQ,IAAI;AACpB,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAKxG,eAAW,eAAe,CAAC,MAAM,cAAc,aAAa,cAAc,aAAa,cAAc,WAAW,GAAG;AACjH,aAAQ,OAAe,WAAW;AAAA,IACpC;AACA,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAGzC,UAAM,SAAS;AACf,UAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,aAAa,CAAC,OAAO,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ;AAC1F,UAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAI,cAAc,CAAC,QAAQ;AACzB,YAAM,UAAU,MAAM,GAAG,yBAAyB;AAAA,QAChD;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,QAAQ,GAAG,EAAE,CAAC;AAAA,IACjF;AAEA,QAAI;AACF,YAAM,mBAAmB,MAAM,gCAAgC,IAAI;AAAA,QACjE,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AACD,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAEA,UAAM,GAAG,yBAAyB;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,IAAI,EAAE,CAAC;AAAA,EAC1E,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAED,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,MAAI,UAAe,cAAc,aAAa,EAAE,UAAU,YAAY,UAAU,WAAW,IAAI;AAC/F,MAAI,CAAC,SAAS;AACZ,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAE,QAAQ;AAAE,gBAAU;AAAA,IAAK;AAAA,EAC5D;AACA,QAAM,SAAS,iBAAiB,UAAU,OAAO;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,UAAU,SAAS,IAAI,OAAO;AAEtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,EAAE,QAAQ,IAAI;AACpB,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAExG,QAAI;AACF,YAAM,mBAAmB,MAAM,gCAAgC,IAAI;AAAA,QACjE,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AACD,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAEA,UAAM,GAAG,yBAAyB,EAAE,UAAU,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,MAAM,KAAK,CAAC;AAC3H,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,gBAAgB,OAAiD;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AAChD,UAAM,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAC1D,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC,EAAE,YAAY;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { QueryEngine, QueryOptions, Where, Sort } from '@open-mercato/shared/lib/query/types'\nimport { normalizeExportFormat, serializeExport, defaultExportFilename, ensureColumns } from '@open-mercato/shared/lib/crud/exporters'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveOrganizationScope, getSelectedOrganizationFromRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'\nimport { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport { setRecordCustomFields } from '../lib/helpers'\nimport { CustomFieldValue } from '../data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { assertEntityAclForRequest } from '../lib/entityAcl'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('entities').child({ component: 'records' })\n\nlet declaredCustomEntityRestricted: Map<string, boolean> | null = null\nfunction loadDeclaredCustomEntities(): Map<string, boolean> {\n  if (declaredCustomEntityRestricted === null) {\n    try {\n      const mods = getModules() as Array<{ customEntities?: Array<{ id?: string; accessRestricted?: boolean }> }>\n      const map = new Map<string, boolean>()\n      for (const mod of mods ?? []) {\n        for (const spec of mod?.customEntities ?? []) {\n          if (spec?.id) map.set(spec.id, spec.accessRestricted === true)\n        }\n      }\n      // Cache even when empty so we don't rebuild on every request (and fall back\n      // to the DB lookup unnecessarily). Only a thrown getModules() leaves it null\n      // so a genuinely-uninitialized registry is retried.\n      declaredCustomEntityRestricted = map\n    } catch {}\n  }\n  return declaredCustomEntityRestricted ?? new Map<string, boolean>()\n}\nfunction isDeclaredCustomEntity(entityId: string): boolean {\n  return loadDeclaredCustomEntities().has(entityId)\n}\n\ntype RecordsEntityScope = { tenantId: string | null; organizationId: string | null }\n\n// Resolve the CustomEntity registration that applies to THIS caller, most-specific\n// first (org+tenant \u2192 tenant-global \u2192 instance-global), mirroring the overlay\n// precedence used by the entity-definitions list. Scoping matters because the\n// row's `access_restricted` flag is a security control: an unscoped lookup could\n// read another tenant's row for a colliding entityId (e.g. `user:vendors`) and\n// mis-decide the restriction. Returns null when the caller's scope has no row.\nasync function findScopedCustomEntity(em: any, CustomEntity: any, entityId: string, scope: RecordsEntityScope) {\n  const { tenantId, organizationId } = scope\n  const candidates: Array<Record<string, unknown>> = [\n    { entityId, organizationId, tenantId },\n    { entityId, organizationId: null, tenantId },\n    { entityId, organizationId: null, tenantId: null },\n  ]\n  const seen = new Set<string>()\n  for (const where of candidates) {\n    const key = JSON.stringify(where)\n    if (seen.has(key)) continue\n    seen.add(key)\n    const row = await em.findOne(CustomEntity as any, where)\n    if (row) return row\n  }\n  return null\n}\n\nconst CUSTOM_ENTITY_RECORD_RESOURCE_KIND = 'entities.record'\n\ntype RecordsEntityKind = 'system' | 'custom' | 'unknown'\n\n// `restricted` is meaningful only when `kind === 'custom'`; it drives the\n// per-entity ACL gate in `assertEntityAclForRequest`.\ntype RecordsEntityClassification = { kind: RecordsEntityKind; restricted: boolean }\n\n// This surface manages doc-storage records, which exist for CUSTOM entities only.\n// Module-declared ids backed by a registered ORM table are system entities \u2014 their\n// records live in their own module tables/APIs, and stray doc rows for them poisoned\n// read-path classification platform-wide (#2939) \u2014 so they are rejected outright. The\n// previous fallback that classified an entity by the mere presence of\n// `custom_entities_storage` rows is gone: within the allowed set, declaration (ce.ts)\n// or an active `custom_entities` registration is authoritative.\nasync function classifyRecordsEntity(em: any, entityId: string, scope: RecordsEntityScope): Promise<RecordsEntityClassification> {\n  if (isOrmBackedSystemEntityId(em, entityId)) return { kind: 'system', restricted: false }\n  const declared = loadDeclaredCustomEntities()\n  if (declared.has(entityId)) return { kind: 'custom', restricted: declared.get(entityId) === true }\n  try {\n    const { CustomEntity } = await import('../data/entities')\n    // Restriction is decided from the row that applies to THIS caller's scope so\n    // a colliding entityId in another tenant can't flip the flag.\n    const scoped = await findScopedCustomEntity(em, CustomEntity, entityId, scope)\n    if (scoped) return { kind: 'custom', restricted: (scoped as any).accessRestricted === true }\n    // No in-scope registration: preserve the historical custom-vs-unknown\n    // classification (any registration row \u2014 active or soft-deleted \u2014 proves the\n    // id is custom; records persist beyond soft delete, TC-ENTITIES-006). A row\n    // outside the caller's scope never marks the entity restricted for them, and\n    // the record query is itself tenant/org-scoped, so this cannot leak data.\n    const anyRow = await em.findOne(CustomEntity as any, { entityId })\n    if (anyRow) return { kind: 'custom', restricted: false }\n  } catch {}\n  return { kind: 'unknown', restricted: false }\n}\n\nfunction systemEntityRecordsRejection(entityId: string) {\n  return NextResponse.json(\n    { error: 'Records are available for custom entities only', code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, entityId },\n    { status: 400 },\n  )\n}\n\nasync function readCustomEntityRecordUpdatedAt(\n  em: any,\n  input: { entityType: string; entityId: string; organizationId: string | null },\n): Promise<string | null> {\n  try {\n    const db = em.getKysely()\n    let query = db\n      .selectFrom('custom_entities_storage' as any)\n      .select(['updated_at' as any])\n      .where('entity_type' as any, '=', input.entityType)\n      .where('entity_id' as any, '=', input.entityId)\n    query = input.organizationId === null\n      ? query.where('organization_id' as any, 'is', null as any)\n      : query.where('organization_id' as any, '=', input.organizationId)\n    const row = await query.executeTakeFirst()\n    const value = (row as any)?.updated_at\n    if (value instanceof Date) return value.toISOString()\n    if (typeof value === 'string' && value.length > 0) return value\n    return null\n  } catch {\n    return null\n  }\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },\n  POST: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.records.manage'] },\n}\n\nconst DEFAULT_EXPORT_PAGE_SIZE = 1000\n\nconst listRecordsQuerySchema = z\n  .object({\n    entityId: z.string().min(1),\n    page: z.coerce.number().int().min(1).optional(),\n    pageSize: z.coerce.number().int().min(1).max(100).optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n    search: z.string().optional(),\n    searchFields: z.string().optional(),\n    withDeleted: z.coerce.boolean().optional(),\n    format: z.enum(['csv', 'json', 'xml', 'markdown']).optional(),\n    exportScope: z.enum(['full']).optional(),\n    export_scope: z.enum(['full']).optional(),\n    all: z.coerce.boolean().optional(),\n    full: z.coerce.boolean().optional(),\n  })\n  .passthrough()\n\nconst recordItemSchema = z.record(z.string(), z.any())\n\nconst listRecordsResponseSchema = z.object({\n  items: z.array(recordItemSchema),\n  total: z.number(),\n  page: z.number(),\n  pageSize: z.number(),\n  totalPages: z.number(),\n})\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const requestedExport = normalizeExportFormat(url.searchParams.get('format'))\n  const exportScopeRaw = (url.searchParams.get('exportScope') || url.searchParams.get('export_scope') || '').toLowerCase()\n  const exportFullRequested = requestedExport != null && (exportScopeRaw === 'full' || parseBooleanWithDefault(url.searchParams.get('full'), false))\n  const exportAll = parseBooleanWithDefault(url.searchParams.get('all'), false)\n  const noPagination = exportAll || requestedExport != null\n  const page = noPagination ? 1 : Math.max(parseInt(url.searchParams.get('page') || '1', 10) || 1, 1)\n  const basePageSize = Math.min(Math.max(parseInt(url.searchParams.get('pageSize') || '50', 10) || 50, 1), 100)\n  const pageSize = noPagination ? Math.max(basePageSize, DEFAULT_EXPORT_PAGE_SIZE) : basePageSize\n  const sortField = url.searchParams.get('sortField') || 'id'\n  const sortDir = (url.searchParams.get('sortDir') || 'asc').toLowerCase() === 'desc' ? 'desc' : 'asc'\n  const withDeleted = parseBooleanWithDefault(url.searchParams.get('withDeleted'), false)\n  const searchTerm = (url.searchParams.get('search') || '').trim()\n  const searchFields = parseCommaSeparatedList(url.searchParams.get('searchFields'))\n\n  const qpEntries: Array<[string, string]> = []\n  for (const [key, val] of url.searchParams.entries()) {\n    if (['entityId','page','pageSize','sortField','sortDir','withDeleted','format','exportScope','export_scope','all','full','search','searchFields'].includes(key)) continue\n    qpEntries.push([key, val])\n  }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const qe = resolve('queryEngine') as QueryEngine\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    let organizationIds: string[] | null = scope.filterIds\n    // Module-declared custom entities (ce.ts) carry frozen system-style ids and are never\n    // registered in `custom_entities`, so classification checks the declared registry plus\n    // active registrations. System (table-backed) ids are rejected above; for the allowed\n    // set `isCustomEntity` drives mapRow's cf_ stripping so the edit form reads back values.\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'view', isCustomEntity, isRestricted, rbac })\n    if (organizationIds && organizationIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n    }\n    const normalizeCustomEntityValue = (value: unknown) => {\n      if (Array.isArray(value)) {\n        return value.map((entry) => {\n          if (typeof entry !== 'string') return entry\n          const parsed = parseBooleanToken(entry)\n          return parsed === null ? entry : parsed\n        })\n      }\n      if (typeof value !== 'string') return value\n      const parsed = parseBooleanToken(value)\n      return parsed === null ? value : parsed\n    }\n    const mapRow = (row: any) => {\n      if (!isCustomEntity || !row || typeof row !== 'object') return row\n      const out: Record<string, unknown> = {}\n      for (const [k, v] of Object.entries(row)) {\n        if (k.startsWith('cf_')) out[k.replace(/^cf_/, '')] = normalizeCustomEntityValue(v)\n        else out[k] = v\n      }\n      return out\n    }\n    const mapFullRow = (row: any) => {\n      if (!row || typeof row !== 'object') return row\n      return { ...(row as Record<string, unknown>) }\n    }\n    // Build filters with awareness of custom-entity mode\n    const filtersObj: Where<any> = {}\n    const buildFilter = (key: string, val: string, allowAnyKey: boolean) => {\n      if (key.startsWith('cf_')) {\n        if (key.endsWith('In')) {\n          const base = key.slice(0, -2)\n          const values = parseCommaSeparatedList(val)\n          ;(filtersObj as any)[base] = { $in: values }\n        } else {\n          if (val.includes(',')) {\n            const values = parseCommaSeparatedList(val)\n            ;(filtersObj as any)[key] = { $in: values }\n          } else {\n            const parsed = parseBooleanToken(val)\n            ;(filtersObj as any)[key] = parsed === null ? val : parsed\n          }\n        }\n      } else if (allowAnyKey) {\n        if (val.includes(',')) {\n          const values = parseCommaSeparatedList(val)\n          ;(filtersObj as any)[key] = { $in: values }\n        } else {\n          const parsed = parseBooleanToken(val)\n          ;(filtersObj as any)[key] = parsed === null ? val : parsed\n        }\n      } else {\n        if (['id', 'created_at', 'updated_at', 'deleted_at', 'name', 'title', 'email'].includes(key)) {\n          ;(filtersObj as any)[key] = val\n        }\n      }\n    }\n\n    if (organizationIds && organizationIds.length) {\n      (filtersObj as any).organization_id = { $in: organizationIds }\n    }\n    const qopts: QueryOptions = {\n      tenantId: auth.tenantId!,\n      includeCustomFields: true,\n      page: { page, pageSize },\n      sort: [{ field: sortField as any, dir: sortDir as any }] as Sort[],\n      filters: filtersObj as any,\n      withDeleted,\n    }\n    if (organizationIds && organizationIds.length) {\n      qopts.organizationIds = organizationIds\n    }\n    // Allowed entities are doc-storage-backed by definition (system ids were rejected\n    // above) \u2014 direct the engine to doc storage explicitly so reads stay deterministic\n    // even before the first record exists.\n    if (isCustomEntity) qopts.forceCustomEntityStorage = true\n    for (const [k, v] of qpEntries) buildFilter(k, v, isCustomEntity)\n    // Server-side full-result search: match the term against the requested fields\n    // (defaults to `id`) before pagination so totals/exports stay consistent with\n    // the active search instead of filtering only the current client page (#3229).\n    if (searchTerm) {\n      const fields = searchFields.length ? searchFields : ['id']\n      const pattern = `%${searchTerm}%`\n      const orClauses = fields.map((field) => ({ [field]: { $ilike: pattern } }))\n      ;(filtersObj as any).$or = orClauses\n    }\n    const res = await qe.query(entityId as any, qopts)\n    const rawItems = res.items || []\n    const viewPageItems = rawItems.map(mapRow)\n    const fullPageItems = rawItems.map(mapFullRow)\n\n    // Expose `updated_at` on custom-entity records. The query engine returns only\n    // the `doc` fields + `id`, dropping the base `updated_at` column \u2014 which made\n    // optimistic locking impossible end-to-end (no version for the edit page to\n    // round-trip as the lock header). Batch-read it from storage and merge it in.\n    if (isCustomEntity && viewPageItems.length) {\n      try {\n        const recordIds = viewPageItems\n          .map((it: any) => it?.id)\n          .filter((v: any): v is string => typeof v === 'string' && v.length > 0)\n        if (recordIds.length) {\n          const db = em.getKysely()\n          const rows = await db\n            .selectFrom('custom_entities_storage' as any)\n            .select(['entity_id' as any, 'updated_at' as any])\n            .where('entity_type' as any, '=', entityId)\n            .where('entity_id' as any, 'in', recordIds as any)\n            .execute()\n          const updatedById = new Map<string, string>()\n          for (const row of rows as any[]) {\n            const value = row?.updated_at\n            const iso = value instanceof Date ? value.toISOString() : (typeof value === 'string' && value.length > 0 ? value : null)\n            if (iso && row?.entity_id) updatedById.set(String(row.entity_id), iso)\n          }\n          for (const item of viewPageItems as any[]) {\n            const iso = updatedById.get(String(item?.id))\n            if (iso) {\n              item.updated_at = iso\n              item.updatedAt = iso\n            }\n          }\n        }\n      } catch { /* best-effort: locking simply will not engage if storage is unavailable */ }\n    }\n\n    const total = typeof res.total === 'number' ? res.total : rawItems.length\n    const effectivePageSize = res.pageSize || pageSize\n    const payload = {\n      items: viewPageItems,\n      total,\n      page: res.page || page,\n      pageSize: effectivePageSize,\n      totalPages: Math.ceil(total / (effectivePageSize || 1)),\n    }\n\n    if (requestedExport) {\n      let exportItems: any[] = exportFullRequested ? [...fullPageItems] : [...viewPageItems]\n      if (total > exportItems.length) {\n        let nextPage = 2\n        while (exportItems.length < total) {\n          const nextRes = await qe.query(entityId as any, {\n            ...qopts,\n            page: { page: nextPage, pageSize },\n          })\n          const nextRawItems = nextRes.items || []\n          if (!nextRawItems.length) break\n          const nextViewItems = nextRawItems.map(mapRow)\n          const nextFullItems = nextRawItems.map(mapFullRow)\n          const nextBatch = exportFullRequested ? nextFullItems : nextViewItems\n          exportItems.push(...nextBatch)\n          if (nextBatch.length < pageSize) break\n          nextPage += 1\n        }\n      }\n      const prepared = {\n        columns: ensureColumns(exportItems),\n        rows: exportItems,\n      }\n      const filenameBase = exportFullRequested ? `${entityId || 'records'}_full` : entityId || 'records'\n      const serialized = serializeExport(prepared, requestedExport)\n      const filename = defaultExportFilename(filenameBase, requestedExport)\n      return new Response(serialized.body, {\n        headers: {\n          'content-type': serialized.contentType,\n          'content-disposition': `attachment; filename=\"${filename}\"`,\n        },\n      })\n    }\n\n    return NextResponse.json(payload)\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    logger.error('Records GET failed', { err: e })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst postBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1).optional(),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst putBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  values: z.record(z.string(), z.any()).default({}),\n})\n\nconst mutationResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z\n    .object({\n      entityId: z.string(),\n      recordId: z.string(),\n    })\n    .optional(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: unknown\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = postBodySchema.safeParse(json)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId } = parsed.data\n  let { recordId, values } = parsed.data as { recordId?: string; values: Record<string, any> }\n\n  try {\n    const { resolve } = await createRequestContainer()\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n    // Strip reserved record/system columns the edit form echoes back from the loaded record\n    // (`id`, plus `updated_at`/`updatedAt` used for optimistic locking). They are not custom\n    // fields; without this they validate as cf_id / cf_updated_at / cf_updatedAt and are\n    // rejected as \"Unknown custom field\", which fails EVERY custom-entity edit-form save.\n    for (const reservedKey of ['id', 'created_at', 'createdAt', 'updated_at', 'updatedAt', 'deleted_at', 'deletedAt']) {\n      delete (values as any)[reservedKey]\n    }\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    const normalizedRecordId = (() => {\n      const raw = String(recordId || '').trim()\n      if (!raw) return undefined\n      const low = raw.toLowerCase()\n      if (low === 'create' || low === 'new' || low === 'null' || low === 'undefined') return undefined\n      // Enforce UUID only; any non-uuid is ignored so we generate one in the DE\n      const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n      return uuid.test(raw) ? raw : undefined\n    })()\n    const { id } = await de.createCustomEntityRecord({\n      entityId,\n      recordId: normalizedRecordId,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n\n    return NextResponse.json({ ok: true, item: { entityId, recordId: id } })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    logger.error('Records POST failed', { err: e })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\n// Avoid zod here to prevent runtime import issues in some environments\nfunction parsePutBody(json: any): { ok: true; data: { entityId: string; recordId: string; values: Record<string, any> } } | { ok: false; error: string } {\n  if (!json || typeof json !== 'object') return { ok: false, error: 'Invalid JSON' }\n  const entityId = typeof json.entityId === 'string' && json.entityId.length ? json.entityId : ''\n  const recordId = typeof json.recordId === 'string' && json.recordId.length ? json.recordId : ''\n  const values = (json.values && typeof json.values === 'object') ? json.values as Record<string, any> : {}\n  if (!entityId || !recordId) return { ok: false, error: 'entityId and recordId are required' }\n  return { ok: true, data: { entityId, recordId, values } }\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let json: any\n  try { json = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = parsePutBody(json)\n  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: 400 })\n  const { entityId, recordId, values } = parsed.data\n\n  try {\n    const container = await createRequestContainer()\n    const { resolve } = container\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n    // Strip reserved record/system columns the edit form echoes back from the loaded record\n    // (`id`, plus `updated_at`/`updatedAt` used for optimistic locking). They are not custom\n    // fields; without this they validate as cf_id / cf_updated_at / cf_updatedAt and are\n    // rejected as \"Unknown custom field\", which fails EVERY custom-entity edit-form save.\n    for (const reservedKey of ['id', 'created_at', 'createdAt', 'updated_at', 'updatedAt', 'deleted_at', 'deletedAt']) {\n      delete (values as any)[reservedKey]\n    }\n    const norm = normalizeValues(values)\n\n    // Validate against custom field definitions\n    try {\n      const { validateCustomFieldValuesServer } = await import('../lib/validation')\n      const check = await validateCustomFieldValuesServer(em, { entityId, organizationId: targetOrgId, tenantId: auth.tenantId!, values: norm, rejectUndeclaredKeys: true })\n      if (!check.ok) return NextResponse.json({ error: 'Validation failed', fields: check.fieldErrors }, { status: 400 })\n    } catch { /* ignore if helper missing */ }\n\n    // Normalize recordId: if blank/sentinel/non-uuid => create instead of update\n    const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n    const rid = String(recordId || '').trim()\n    const low = rid.toLowerCase()\n    const isSentinel = !rid || low === 'create' || low === 'new' || low === 'null' || low === 'undefined'\n    const isUuid = uuidRe.test(rid)\n    if (isSentinel || !isUuid) {\n      const created = await de.createCustomEntityRecord({\n        entityId,\n        recordId: undefined,\n        organizationId: targetOrgId,\n        tenantId: auth.tenantId!,\n        values: norm,\n      })\n      return NextResponse.json({ ok: true, item: { entityId, recordId: created.id } })\n    }\n\n    try {\n      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {\n        entityType: entityId,\n        entityId: rid,\n        organizationId: targetOrgId,\n      })\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,\n        resourceId: rid,\n        current: currentUpdatedAt,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    await de.updateCustomEntityRecord({\n      entityId,\n      recordId: rid,\n      organizationId: targetOrgId,\n      tenantId: auth.tenantId!,\n      values: norm,\n    })\n    return NextResponse.json({ ok: true, item: { entityId, recordId: rid } })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst deleteBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n})\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const qpEntityId = url.searchParams.get('entityId')\n  const qpRecordId = url.searchParams.get('recordId')\n  let payload: any = qpEntityId && qpRecordId ? { entityId: qpEntityId, recordId: qpRecordId } : null\n  if (!payload) {\n    try { payload = await req.json() } catch { payload = null }\n  }\n  const parsed = deleteBodySchema.safeParse(payload)\n  if (!parsed.success) return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  const { entityId, recordId } = parsed.data\n\n  try {\n    const container = await createRequestContainer()\n    const { resolve } = container\n    const de = resolve('dataEngine') as any\n    const em = resolve('em') as any\n    const rbac = resolve('rbacService') as RbacService\n    const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) })\n    const targetOrgId = scope.selectedId ?? auth.orgId\n    if (!targetOrgId) return NextResponse.json({ error: 'Organization context is required' }, { status: 400 })\n    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null })\n    if (entityKind === 'system') return systemEntityRecordsRejection(entityId)\n    const isCustomEntity = entityKind === 'custom'\n    await assertEntityAclForRequest({ auth, entityId, action: 'manage', isCustomEntity, isRestricted, rbac })\n\n    try {\n      const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {\n        entityType: entityId,\n        entityId: recordId,\n        organizationId: targetOrgId,\n      })\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_RECORD_RESOURCE_KIND,\n        resourceId: recordId,\n        current: currentUpdatedAt,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n\n    await de.deleteCustomEntityRecord({ entityId, recordId, organizationId: targetOrgId, tenantId: auth.tenantId!, soft: true })\n    return NextResponse.json({ ok: true })\n  } catch (e) {\n    if (isCrudHttpError(e)) return NextResponse.json(e.body, { status: e.status })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nfunction normalizeValues(input: Record<string, any>): Record<string, any> {\n  const out: Record<string, any> = {}\n  for (const [k, v] of Object.entries(input || {})) {\n    const key = k.startsWith('cf_') ? k.replace(/^cf_/, '') : k\n    out[key] = v\n  }\n  return out\n}\n\nconst deleteResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n}).passthrough()\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'CRUD operations on entity records',\n  methods: {\n    GET: {\n      summary: 'List records',\n      description:\n        'Returns paginated records for the supplied entity. Supports custom field filters, exports, and soft-delete toggles.',\n      query: listRecordsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated records',\n          schema: listRecordsResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    POST: {\n      summary: 'Create record',\n      description:\n        'Creates a record for the given entity. When `recordId` is omitted or not a UUID the data engine will generate one automatically.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: postBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record created',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    PUT: {\n      summary: 'Update record',\n      description:\n        'Updates an existing record. If the provided recordId is not a UUID the record will be created instead to support optimistic flows.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record updated',\n          schema: mutationResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation failure',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete record',\n      description: 'Soft deletes the specified record within the current tenant/org scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteBodySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Record deleted',\n          schema: deleteResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Missing entity id or record id',\n          schema: errorSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: errorSchema,\n        },\n        {\n          status: 404,\n          description: 'Record not found',\n          schema: errorSchema,\n        },\n        {\n          status: 500,\n          description: 'Unexpected failure',\n          schema: errorSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,iBAAiB,uBAAuB,qBAAqB;AAE7F,SAAS,0BAA0B,0CAA0C;AAC7E,SAAS,oCAAoC,iCAAiC;AAC9E,SAAS,mBAAmB,+BAA+B;AAC3D,SAAS,+BAA+B;AAIxC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEtE,IAAI,iCAA8D;AAClE,SAAS,6BAAmD;AAC1D,MAAI,mCAAmC,MAAM;AAC3C,QAAI;AACF,YAAM,OAAO,WAAW;AACxB,YAAM,MAAM,oBAAI,IAAqB;AACrC,iBAAW,OAAO,QAAQ,CAAC,GAAG;AAC5B,mBAAW,QAAQ,KAAK,kBAAkB,CAAC,GAAG;AAC5C,cAAI,MAAM,GAAI,KAAI,IAAI,KAAK,IAAI,KAAK,qBAAqB,IAAI;AAAA,QAC/D;AAAA,MACF;AAIA,uCAAiC;AAAA,IACnC,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,SAAO,kCAAkC,oBAAI,IAAqB;AACpE;AACA,SAAS,uBAAuB,UAA2B;AACzD,SAAO,2BAA2B,EAAE,IAAI,QAAQ;AAClD;AAUA,eAAe,uBAAuB,IAAS,cAAmB,UAAkB,OAA2B;AAC7G,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,QAAM,aAA6C;AAAA,IACjD,EAAE,UAAU,gBAAgB,SAAS;AAAA,IACrC,EAAE,UAAU,gBAAgB,MAAM,SAAS;AAAA,IAC3C,EAAE,UAAU,gBAAgB,MAAM,UAAU,KAAK;AAAA,EACnD;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,YAAY;AAC9B,UAAM,MAAM,KAAK,UAAU,KAAK;AAChC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAqB,KAAK;AACvD,QAAI,IAAK,QAAO;AAAA,EAClB;AACA,SAAO;AACT;AAEA,MAAM,qCAAqC;AAe3C,eAAe,sBAAsB,IAAS,UAAkB,OAAiE;AAC/H,MAAI,0BAA0B,IAAI,QAAQ,EAAG,QAAO,EAAE,MAAM,UAAU,YAAY,MAAM;AACxF,QAAM,WAAW,2BAA2B;AAC5C,MAAI,SAAS,IAAI,QAAQ,EAAG,QAAO,EAAE,MAAM,UAAU,YAAY,SAAS,IAAI,QAAQ,MAAM,KAAK;AACjG,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,OAAO,kBAAkB;AAGxD,UAAM,SAAS,MAAM,uBAAuB,IAAI,cAAc,UAAU,KAAK;AAC7E,QAAI,OAAQ,QAAO,EAAE,MAAM,UAAU,YAAa,OAAe,qBAAqB,KAAK;AAM3F,UAAM,SAAS,MAAM,GAAG,QAAQ,cAAqB,EAAE,SAAS,CAAC;AACjE,QAAI,OAAQ,QAAO,EAAE,MAAM,UAAU,YAAY,MAAM;AAAA,EACzD,QAAQ;AAAA,EAAC;AACT,SAAO,EAAE,MAAM,WAAW,YAAY,MAAM;AAC9C;AAEA,SAAS,6BAA6B,UAAkB;AACtD,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,kDAAkD,MAAM,oCAAoC,SAAS;AAAA,IAC9G,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,gCACb,IACA,OACwB;AACxB,MAAI;AACF,UAAM,KAAK,GAAG,UAAU;AACxB,QAAI,QAAQ,GACT,WAAW,yBAAgC,EAC3C,OAAO,CAAC,YAAmB,CAAC,EAC5B,MAAM,eAAsB,KAAK,MAAM,UAAU,EACjD,MAAM,aAAoB,KAAK,MAAM,QAAQ;AAChD,YAAQ,MAAM,mBAAmB,OAC7B,MAAM,MAAM,mBAA0B,MAAM,IAAW,IACvD,MAAM,MAAM,mBAA0B,KAAK,MAAM,cAAc;AACnE,UAAM,MAAM,MAAM,MAAM,iBAAiB;AACzC,UAAM,QAAS,KAAa;AAC5B,QAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACxE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,MAAM,2BAA2B;AAEjC,MAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,aAAa,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,OAAO,QAAQ,OAAO,UAAU,CAAC,EAAE,SAAS;AAAA,EAC5D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACvC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,SAAS;AAAA,EACxC,KAAK,EAAE,OAAO,QAAQ,EAAE,SAAS;AAAA,EACjC,MAAM,EAAE,OAAO,QAAQ,EAAE,SAAS;AACpC,CAAC,EACA,YAAY;AAEf,MAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC;AAErD,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,kBAAkB,sBAAsB,IAAI,aAAa,IAAI,QAAQ,CAAC;AAC5E,QAAM,kBAAkB,IAAI,aAAa,IAAI,aAAa,KAAK,IAAI,aAAa,IAAI,cAAc,KAAK,IAAI,YAAY;AACvH,QAAM,sBAAsB,mBAAmB,SAAS,mBAAmB,UAAU,wBAAwB,IAAI,aAAa,IAAI,MAAM,GAAG,KAAK;AAChJ,QAAM,YAAY,wBAAwB,IAAI,aAAa,IAAI,KAAK,GAAG,KAAK;AAC5E,QAAM,eAAe,aAAa,mBAAmB;AACrD,QAAM,OAAO,eAAe,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,KAAK,EAAE,KAAK,GAAG,CAAC;AAClG,QAAM,eAAe,KAAK,IAAI,KAAK,IAAI,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,MAAM,EAAE,KAAK,IAAI,CAAC,GAAG,GAAG;AAC5G,QAAM,WAAW,eAAe,KAAK,IAAI,cAAc,wBAAwB,IAAI;AACnF,QAAM,YAAY,IAAI,aAAa,IAAI,WAAW,KAAK;AACvD,QAAM,WAAW,IAAI,aAAa,IAAI,SAAS,KAAK,OAAO,YAAY,MAAM,SAAS,SAAS;AAC/F,QAAM,cAAc,wBAAwB,IAAI,aAAa,IAAI,aAAa,GAAG,KAAK;AACtF,QAAM,cAAc,IAAI,aAAa,IAAI,QAAQ,KAAK,IAAI,KAAK;AAC/D,QAAM,eAAe,wBAAwB,IAAI,aAAa,IAAI,cAAc,CAAC;AAEjF,QAAM,YAAqC,CAAC;AAC5C,aAAW,CAAC,KAAK,GAAG,KAAK,IAAI,aAAa,QAAQ,GAAG;AACnD,QAAI,CAAC,YAAW,QAAO,YAAW,aAAY,WAAU,eAAc,UAAS,eAAc,gBAAe,OAAM,QAAO,UAAS,cAAc,EAAE,SAAS,GAAG,EAAG;AACjK,cAAU,KAAK,CAAC,KAAK,GAAG,CAAC;AAAA,EAC3B;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,aAAa;AAChC,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,QAAI,kBAAmC,MAAM;AAK7C,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,QAAQ,gBAAgB,cAAc,KAAK,CAAC;AACtG,QAAI,mBAAmB,gBAAgB,WAAW,GAAG;AACnD,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,6BAA6B,CAAC,UAAmB;AACrD,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAO,MAAM,IAAI,CAAC,UAAU;AAC1B,cAAI,OAAO,UAAU,SAAU,QAAO;AACtC,gBAAMA,UAAS,kBAAkB,KAAK;AACtC,iBAAOA,YAAW,OAAO,QAAQA;AAAA,QACnC,CAAC;AAAA,MACH;AACA,UAAI,OAAO,UAAU,SAAU,QAAO;AACtC,YAAM,SAAS,kBAAkB,KAAK;AACtC,aAAO,WAAW,OAAO,QAAQ;AAAA,IACnC;AACA,UAAM,SAAS,CAAC,QAAa;AAC3B,UAAI,CAAC,kBAAkB,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC/D,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,YAAI,EAAE,WAAW,KAAK,EAAG,KAAI,EAAE,QAAQ,QAAQ,EAAE,CAAC,IAAI,2BAA2B,CAAC;AAAA,YAC7E,KAAI,CAAC,IAAI;AAAA,MAChB;AACA,aAAO;AAAA,IACT;AACA,UAAM,aAAa,CAAC,QAAa;AAC/B,UAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,aAAO,EAAE,GAAI,IAAgC;AAAA,IAC/C;AAEA,UAAM,aAAyB,CAAC;AAChC,UAAM,cAAc,CAAC,KAAa,KAAa,gBAAyB;AACtE,UAAI,IAAI,WAAW,KAAK,GAAG;AACzB,YAAI,IAAI,SAAS,IAAI,GAAG;AACtB,gBAAM,OAAO,IAAI,MAAM,GAAG,EAAE;AAC5B,gBAAM,SAAS,wBAAwB,GAAG;AACzC,UAAC,WAAmB,IAAI,IAAI,EAAE,KAAK,OAAO;AAAA,QAC7C,OAAO;AACL,cAAI,IAAI,SAAS,GAAG,GAAG;AACrB,kBAAM,SAAS,wBAAwB,GAAG;AACzC,YAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,UAC5C,OAAO;AACL,kBAAM,SAAS,kBAAkB,GAAG;AACnC,YAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,UACtD;AAAA,QACF;AAAA,MACF,WAAW,aAAa;AACtB,YAAI,IAAI,SAAS,GAAG,GAAG;AACrB,gBAAM,SAAS,wBAAwB,GAAG;AACzC,UAAC,WAAmB,GAAG,IAAI,EAAE,KAAK,OAAO;AAAA,QAC5C,OAAO;AACL,gBAAM,SAAS,kBAAkB,GAAG;AACnC,UAAC,WAAmB,GAAG,IAAI,WAAW,OAAO,MAAM;AAAA,QACtD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,cAAc,cAAc,cAAc,QAAQ,SAAS,OAAO,EAAE,SAAS,GAAG,GAAG;AAC5F;AAAC,UAAC,WAAmB,GAAG,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAEA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,MAAC,WAAmB,kBAAkB,EAAE,KAAK,gBAAgB;AAAA,IAC/D;AACA,UAAM,QAAsB;AAAA,MAC1B,UAAU,KAAK;AAAA,MACf,qBAAqB;AAAA,MACrB,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,MAAM,CAAC,EAAE,OAAO,WAAkB,KAAK,QAAe,CAAC;AAAA,MACvD,SAAS;AAAA,MACT;AAAA,IACF;AACA,QAAI,mBAAmB,gBAAgB,QAAQ;AAC7C,YAAM,kBAAkB;AAAA,IAC1B;AAIA,QAAI,eAAgB,OAAM,2BAA2B;AACrD,eAAW,CAAC,GAAG,CAAC,KAAK,UAAW,aAAY,GAAG,GAAG,cAAc;AAIhE,QAAI,YAAY;AACd,YAAM,SAAS,aAAa,SAAS,eAAe,CAAC,IAAI;AACzD,YAAM,UAAU,IAAI,UAAU;AAC9B,YAAM,YAAY,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,GAAG,EAAE,QAAQ,QAAQ,EAAE,EAAE;AACzE,MAAC,WAAmB,MAAM;AAAA,IAC7B;AACA,UAAM,MAAM,MAAM,GAAG,MAAM,UAAiB,KAAK;AACjD,UAAM,WAAW,IAAI,SAAS,CAAC;AAC/B,UAAM,gBAAgB,SAAS,IAAI,MAAM;AACzC,UAAM,gBAAgB,SAAS,IAAI,UAAU;AAM7C,QAAI,kBAAkB,cAAc,QAAQ;AAC1C,UAAI;AACF,cAAM,YAAY,cACf,IAAI,CAAC,OAAY,IAAI,EAAE,EACvB,OAAO,CAAC,MAAwB,OAAO,MAAM,YAAY,EAAE,SAAS,CAAC;AACxE,YAAI,UAAU,QAAQ;AACpB,gBAAM,KAAK,GAAG,UAAU;AACxB,gBAAM,OAAO,MAAM,GAChB,WAAW,yBAAgC,EAC3C,OAAO,CAAC,aAAoB,YAAmB,CAAC,EAChD,MAAM,eAAsB,KAAK,QAAQ,EACzC,MAAM,aAAoB,MAAM,SAAgB,EAChD,QAAQ;AACX,gBAAM,cAAc,oBAAI,IAAoB;AAC5C,qBAAW,OAAO,MAAe;AAC/B,kBAAM,QAAQ,KAAK;AACnB,kBAAM,MAAM,iBAAiB,OAAO,MAAM,YAAY,IAAK,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACnH,gBAAI,OAAO,KAAK,UAAW,aAAY,IAAI,OAAO,IAAI,SAAS,GAAG,GAAG;AAAA,UACvE;AACA,qBAAW,QAAQ,eAAwB;AACzC,kBAAM,MAAM,YAAY,IAAI,OAAO,MAAM,EAAE,CAAC;AAC5C,gBAAI,KAAK;AACP,mBAAK,aAAa;AAClB,mBAAK,YAAY;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAA8E;AAAA,IACxF;AAEA,UAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,SAAS;AACnE,UAAM,oBAAoB,IAAI,YAAY;AAC1C,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,IAAI,QAAQ;AAAA,MAClB,UAAU;AAAA,MACV,YAAY,KAAK,KAAK,SAAS,qBAAqB,EAAE;AAAA,IACxD;AAEA,QAAI,iBAAiB;AACnB,UAAI,cAAqB,sBAAsB,CAAC,GAAG,aAAa,IAAI,CAAC,GAAG,aAAa;AACrF,UAAI,QAAQ,YAAY,QAAQ;AAC9B,YAAI,WAAW;AACf,eAAO,YAAY,SAAS,OAAO;AACjC,gBAAM,UAAU,MAAM,GAAG,MAAM,UAAiB;AAAA,YAC9C,GAAG;AAAA,YACH,MAAM,EAAE,MAAM,UAAU,SAAS;AAAA,UACnC,CAAC;AACD,gBAAM,eAAe,QAAQ,SAAS,CAAC;AACvC,cAAI,CAAC,aAAa,OAAQ;AAC1B,gBAAM,gBAAgB,aAAa,IAAI,MAAM;AAC7C,gBAAM,gBAAgB,aAAa,IAAI,UAAU;AACjD,gBAAM,YAAY,sBAAsB,gBAAgB;AACxD,sBAAY,KAAK,GAAG,SAAS;AAC7B,cAAI,UAAU,SAAS,SAAU;AACjC,sBAAY;AAAA,QACd;AAAA,MACF;AACA,YAAM,WAAW;AAAA,QACf,SAAS,cAAc,WAAW;AAAA,QAClC,MAAM;AAAA,MACR;AACA,YAAM,eAAe,sBAAsB,GAAG,YAAY,SAAS,UAAU,YAAY;AACzF,YAAM,aAAa,gBAAgB,UAAU,eAAe;AAC5D,YAAM,WAAW,sBAAsB,cAAc,eAAe;AACpE,aAAO,IAAI,SAAS,WAAW,MAAM;AAAA,QACnC,SAAS;AAAA,UACP,gBAAgB,WAAW;AAAA,UAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,QAC1D;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,MAAM,sBAAsB,EAAE,KAAK,EAAE,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EACH,OAAO;AAAA,IACN,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO;AAAA,EACrB,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,SAAS,IAAI,OAAO;AAC5B,MAAI,EAAE,UAAU,OAAO,IAAI,OAAO;AAElC,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAKxG,eAAW,eAAe,CAAC,MAAM,cAAc,aAAa,cAAc,aAAa,cAAc,WAAW,GAAG;AACjH,aAAQ,OAAe,WAAW;AAAA,IACpC;AACA,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAEzC,UAAM,sBAAsB,MAAM;AAChC,YAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,MAAM,IAAI,YAAY;AAC5B,UAAI,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ,YAAa,QAAO;AAEvF,YAAM,OAAO;AACb,aAAO,KAAK,KAAK,GAAG,IAAI,MAAM;AAAA,IAChC,GAAG;AACH,UAAM,EAAE,GAAG,IAAI,MAAM,GAAG,yBAAyB;AAAA,MAC/C;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,GAAG,EAAE,CAAC;AAAA,EACzE,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,MAAM,uBAAuB,EAAE,KAAK,EAAE,CAAC;AAC9C,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAGA,SAAS,aAAa,MAAmI;AACvJ,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,eAAe;AACjF,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,WAAW,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,KAAK,WAAW;AAC7F,QAAM,SAAU,KAAK,UAAU,OAAO,KAAK,WAAW,WAAY,KAAK,SAAgC,CAAC;AACxG,MAAI,CAAC,YAAY,CAAC,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,qCAAqC;AAC5F,SAAO,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,OAAO,EAAE;AAC1D;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,aAAa,IAAI;AAChC,MAAI,CAAC,OAAO,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjF,QAAM,EAAE,UAAU,UAAU,OAAO,IAAI,OAAO;AAE9C,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,EAAE,QAAQ,IAAI;AACpB,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAKxG,eAAW,eAAe,CAAC,MAAM,cAAc,aAAa,cAAc,aAAa,cAAc,WAAW,GAAG;AACjH,aAAQ,OAAe,WAAW;AAAA,IACpC;AACA,UAAM,OAAO,gBAAgB,MAAM;AAGnC,QAAI;AACF,YAAM,EAAE,gCAAgC,IAAI,MAAM,OAAO,mBAAmB;AAC5E,YAAM,QAAQ,MAAM,gCAAgC,IAAI,EAAE,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,QAAQ,MAAM,sBAAsB,KAAK,CAAC;AACrK,UAAI,CAAC,MAAM,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,QAAQ,MAAM,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH,QAAQ;AAAA,IAAiC;AAGzC,UAAM,SAAS;AACf,UAAM,MAAM,OAAO,YAAY,EAAE,EAAE,KAAK;AACxC,UAAM,MAAM,IAAI,YAAY;AAC5B,UAAM,aAAa,CAAC,OAAO,QAAQ,YAAY,QAAQ,SAAS,QAAQ,UAAU,QAAQ;AAC1F,UAAM,SAAS,OAAO,KAAK,GAAG;AAC9B,QAAI,cAAc,CAAC,QAAQ;AACzB,YAAM,UAAU,MAAM,GAAG,yBAAyB;AAAA,QAChD;AAAA,QACA,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,QAAQ;AAAA,MACV,CAAC;AACD,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,QAAQ,GAAG,EAAE,CAAC;AAAA,IACjF;AAEA,QAAI;AACF,YAAM,mBAAmB,MAAM,gCAAgC,IAAI;AAAA,QACjE,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AACD,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAEA,UAAM,GAAG,yBAAyB;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,UAAU,KAAK;AAAA,MACf,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,UAAU,UAAU,IAAI,EAAE,CAAC;AAAA,EAC1E,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAC5B,CAAC;AAED,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,QAAM,aAAa,IAAI,aAAa,IAAI,UAAU;AAClD,MAAI,UAAe,cAAc,aAAa,EAAE,UAAU,YAAY,UAAU,WAAW,IAAI;AAC/F,MAAI,CAAC,SAAS;AACZ,QAAI;AAAE,gBAAU,MAAM,IAAI,KAAK;AAAA,IAAE,QAAQ;AAAE,gBAAU;AAAA,IAAK;AAAA,EAC5D;AACA,QAAM,SAAS,iBAAiB,UAAU,OAAO;AACjD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9H,QAAM,EAAE,UAAU,SAAS,IAAI,OAAO;AAEtC,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,EAAE,QAAQ,IAAI;AACpB,UAAM,KAAK,QAAQ,YAAY;AAC/B,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAO,QAAQ,aAAa;AAClC,UAAM,QAAQ,MAAM,yBAAyB,EAAE,IAAI,MAAM,MAAM,YAAY,mCAAmC,GAAG,EAAE,CAAC;AACpH,UAAM,cAAc,MAAM,cAAc,KAAK;AAC7C,QAAI,CAAC,YAAa,QAAO,aAAa,KAAK,EAAE,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzG,UAAM,EAAE,MAAM,YAAY,YAAY,aAAa,IAAI,MAAM,sBAAsB,IAAI,UAAU,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK,CAAC;AAC5L,QAAI,eAAe,SAAU,QAAO,6BAA6B,QAAQ;AACzE,UAAM,iBAAiB,eAAe;AACtC,UAAM,0BAA0B,EAAE,MAAM,UAAU,QAAQ,UAAU,gBAAgB,cAAc,KAAK,CAAC;AAExG,QAAI;AACF,YAAM,mBAAmB,MAAM,gCAAgC,IAAI;AAAA,QACjE,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,MAClB,CAAC;AACD,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAEA,UAAM,GAAG,yBAAyB,EAAE,UAAU,UAAU,gBAAgB,aAAa,UAAU,KAAK,UAAW,MAAM,KAAK,CAAC;AAC3H,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,GAAG;AACV,QAAI,gBAAgB,CAAC,EAAG,QAAO,aAAa,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC;AAC7E,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,gBAAgB,OAAiD;AACxE,QAAM,MAA2B,CAAC;AAClC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;AAChD,UAAM,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,QAAQ,QAAQ,EAAE,IAAI;AAC1D,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC,EAAE,YAAY;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["parsed"]
 }

package/dist/modules/entities/api/relations/options.js

@@ -5,10 +5,13 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { tableNameFromEntityId } from "@open-mercato/shared/lib/entities/naming";
 import { CustomEntity } from "@open-mercato/core/modules/entities/data/entities";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { resolveRegisteredEntityTableName } from "@open-mercato/shared/lib/query/engine";
+import { createLogger } from "@open-mercato/shared/lib/logger";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["entities.definitions.view"] }
 };
 const ALLOWED_ROUTE_CONTEXT_FIELDS = /* @__PURE__ */ new Set(["kind", "entity_id", "product_id"]);
+const logger = createLogger("entities");
 async function GET(req) {
   const url = new URL(req.url);
   const entityId = url.searchParams.get("entityId") || "";
@@ -30,17 +33,19 @@ async function GET(req) {
   const container = await createRequestContainer();
   const qe = container.resolve("queryEngine");
   const em = container.resolve("em");
-  if (!labelField) {
-    const cfg = await em.findOne(CustomEntity, {
-      entityId,
-      $and: [
-        { $or: [{ organizationId: auth.orgId ?? void 0 }, { organizationId: null }] },
-        { $or: [{ tenantId: auth.tenantId ?? void 0 }, { tenantId: null }] }
-      ],
-      isActive: true
-    });
-    labelField = cfg?.labelField || "";
+  const customEntity = await em.findOne(CustomEntity, {
+    entityId,
+    $and: [
+      { $or: [{ organizationId: auth.orgId ?? void 0 }, { organizationId: null }] },
+      { $or: [{ tenantId: auth.tenantId ?? void 0 }, { tenantId: null }] }
+    ],
+    isActive: true
+  });
+  if (!customEntity && resolveRegisteredEntityTableName(em, entityId) === null) {
+    logger.warn("Relation options requested for an unresolvable entity id", { entityId });
+    return NextResponse.json({ items: [] });
   }
+  if (!labelField) labelField = customEntity?.labelField || "";
   if (!labelField) {
     const candidates = ["name", "title", "code", "email"];
     const table = tableNameFromEntityId(entityId);
@@ -103,7 +108,7 @@ const openApi = {
   methods: {
     GET: {
       summary: "List relation options",
-      description: "Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted.",
+      description: "Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted. An entityId that matches neither an active custom entity nor a registered ORM entity yields an empty option list.",
       query: relationOptionsQuerySchema,
       responses: [
         {

package/dist/modules/entities/api/relations/options.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/entities/api/relations/options.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { tableNameFromEntityId } from '@open-mercato/shared/lib/entities/naming'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.view'] },\n}\n\nconst ALLOWED_ROUTE_CONTEXT_FIELDS = new Set(['kind', 'entity_id', 'product_id'])\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  let labelField = url.searchParams.get('labelField') || ''\n  const q = url.searchParams.get('q') || ''\n  const ids = Array.from(\n    new Set(\n      (url.searchParams.get('ids') || '')\n        .split(',')\n        .map((entry) => entry.trim())\n        .filter((entry) => entry.length > 0),\n    ),\n  )\n  const routeContextFields = Array.from(\n    new Set(\n      (url.searchParams.get('routeContextFields') || '')\n        .split(',')\n        .map((entry) => entry.trim())\n        .filter((entry) => ALLOWED_ROUTE_CONTEXT_FIELDS.has(entry)),\n    ),\n  )\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  if (!entityId) return NextResponse.json({ items: [] })\n\n  const container = await createRequestContainer()\n  const qe = container.resolve('queryEngine') as QueryEngine\n  const em = container.resolve('em') as EntityManager\n\n  if (!labelField) {\n    const cfg = await em.findOne(CustomEntity, {\n      entityId,\n      $and: [\n        { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] },\n        { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n      ],\n      isActive: true,\n    })\n    labelField = (cfg?.labelField as string | undefined) || ''\n  }\n  if (!labelField) {\n    const candidates = ['name', 'title', 'code', 'email']\n    const table = tableNameFromEntityId(entityId)\n    const db = (em as any).getKysely() as any\n    for (const c of candidates) {\n      const exists = await db\n        .selectFrom('information_schema.columns')\n        .select('column_name')\n        .where('table_name', '=', table)\n        .where('column_name', '=', c)\n        .executeTakeFirst()\n      if (exists) { labelField = c; break }\n    }\n    if (!labelField) labelField = 'id'\n  }\n  const filters: Record<string, unknown> = {}\n  if (ids.length === 1) filters.id = ids[0]\n  else if (ids.length > 1) filters.id = { $in: ids }\n  if (q) filters[labelField] = { $ilike: `%${escapeLikePattern(q)}%` }\n  const fields = Array.from(new Set(['id', labelField, ...routeContextFields]))\n  const res = await qe.query(entityId, {\n    tenantId: auth.tenantId ?? undefined,\n    ...(auth.orgId ? { organizationId: auth.orgId } : {}),\n    fields,\n    filters,\n    page: { page: 1, pageSize: Math.min(ids.length || 50, 200) },\n  })\n  const items = (res.items || []).map((it: any) => {\n    const routeContext = routeContextFields.reduce<Record<string, unknown>>((acc, field) => {\n      if (it[field] !== undefined) {\n        acc[field] = it[field]\n      }\n      return acc\n    }, {})\n    return {\n      value: String(it.id),\n      label: String(it[labelField] ?? it.id),\n      ...(Object.keys(routeContext).length > 0 ? { routeContext } : {}),\n    }\n  })\n  return NextResponse.json({ items })\n}\n\nconst relationOptionsQuerySchema = z.object({\n  entityId: z.string().min(1),\n  labelField: z.string().optional(),\n  q: z.string().optional(),\n  ids: z.string().optional(),\n  routeContextFields: z.string().optional(),\n})\n\nconst relationOptionsResponseSchema = z.object({\n  items: z.array(\n    z.object({\n      value: z.string(),\n      label: z.string(),\n      routeContext: z.record(z.string(), z.unknown()).optional(),\n    })\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Relation options lookup',\n  methods: {\n    GET: {\n      summary: 'List relation options',\n      description: 'Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted.',\n      query: relationOptionsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Option list',\n          schema: relationOptionsResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAI7B,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC3E;AAEA,MAAM,+BAA+B,oBAAI,IAAI,CAAC,QAAQ,aAAa,YAAY,CAAC;AAEhF,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,aAAa,IAAI,aAAa,IAAI,YAAY,KAAK;AACvD,QAAM,IAAI,IAAI,aAAa,IAAI,GAAG,KAAK;AACvC,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI;AAAA,OACD,IAAI,aAAa,IAAI,KAAK,KAAK,IAC7B,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,IACvC;AAAA,EACF;AACA,QAAM,qBAAqB,MAAM;AAAA,IAC/B,IAAI;AAAA,OACD,IAAI,aAAa,IAAI,oBAAoB,KAAK,IAC5C,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,6BAA6B,IAAI,KAAK,CAAC;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAErD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,aAAa;AAC1C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,MAAI,CAAC,YAAY;AACf,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAc;AAAA,MACzC;AAAA,MACA,MAAM;AAAA,QACJ,EAAE,KAAK,CAAE,EAAE,gBAAgB,KAAK,SAAS,OAAiB,GAAG,EAAE,gBAAgB,KAAK,CAAE,EAAE;AAAA,QACxF,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,MACjF;AAAA,MACA,UAAU;AAAA,IACZ,CAAC;AACD,iBAAc,KAAK,cAAqC;AAAA,EAC1D;AACA,MAAI,CAAC,YAAY;AACf,UAAM,aAAa,CAAC,QAAQ,SAAS,QAAQ,OAAO;AACpD,UAAM,QAAQ,sBAAsB,QAAQ;AAC5C,UAAM,KAAM,GAAW,UAAU;AACjC,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,MAAM,GAClB,WAAW,4BAA4B,EACvC,OAAO,aAAa,EACpB,MAAM,cAAc,KAAK,KAAK,EAC9B,MAAM,eAAe,KAAK,CAAC,EAC3B,iBAAiB;AACpB,UAAI,QAAQ;AAAE,qBAAa;AAAG;AAAA,MAAM;AAAA,IACtC;AACA,QAAI,CAAC,WAAY,cAAa;AAAA,EAChC;AACA,QAAM,UAAmC,CAAC;AAC1C,MAAI,IAAI,WAAW,EAAG,SAAQ,KAAK,IAAI,CAAC;AAAA,WAC/B,IAAI,SAAS,EAAG,SAAQ,KAAK,EAAE,KAAK,IAAI;AACjD,MAAI,EAAG,SAAQ,UAAU,IAAI,EAAE,QAAQ,IAAI,kBAAkB,CAAC,CAAC,IAAI;AACnE,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC;AAC5E,QAAM,MAAM,MAAM,GAAG,MAAM,UAAU;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;AAAA,IACnD;AAAA,IACA;AAAA,IACA,MAAM,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,GAAG,EAAE;AAAA,EAC7D,CAAC;AACD,QAAM,SAAS,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,OAAY;AAC/C,UAAM,eAAe,mBAAmB,OAAgC,CAAC,KAAK,UAAU;AACtF,UAAI,GAAG,KAAK,MAAM,QAAW;AAC3B,YAAI,KAAK,IAAI,GAAG,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AACL,WAAO;AAAA,MACL,OAAO,OAAO,GAAG,EAAE;AAAA,MACnB,OAAO,OAAO,GAAG,UAAU,KAAK,GAAG,EAAE;AAAA,MACrC,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,IACjE;AAAA,EACF,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAC1C,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO;AAAA,MAChB,OAAO,EAAE,OAAO;AAAA,MAChB,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC3D,CAAC;AAAA,EACH;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { tableNameFromEntityId } from '@open-mercato/shared/lib/entities/naming'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.view'] },\n}\n\nconst ALLOWED_ROUTE_CONTEXT_FIELDS = new Set(['kind', 'entity_id', 'product_id'])\n\nconst logger = createLogger('entities')\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const entityId = url.searchParams.get('entityId') || ''\n  let labelField = url.searchParams.get('labelField') || ''\n  const q = url.searchParams.get('q') || ''\n  const ids = Array.from(\n    new Set(\n      (url.searchParams.get('ids') || '')\n        .split(',')\n        .map((entry) => entry.trim())\n        .filter((entry) => entry.length > 0),\n    ),\n  )\n  const routeContextFields = Array.from(\n    new Set(\n      (url.searchParams.get('routeContextFields') || '')\n        .split(',')\n        .map((entry) => entry.trim())\n        .filter((entry) => ALLOWED_ROUTE_CONTEXT_FIELDS.has(entry)),\n    ),\n  )\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  if (!entityId) return NextResponse.json({ items: [] })\n\n  const container = await createRequestContainer()\n  const qe = container.resolve('queryEngine') as QueryEngine\n  const em = container.resolve('em') as EntityManager\n\n  const customEntity = await em.findOne(CustomEntity, {\n    entityId,\n    $and: [\n      { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] },\n      { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n    ],\n    isActive: true,\n  })\n\n  // A relation field can point at an entity that does not exist \u2014 most often a half-configured\n  // `relatedEntityId` that was never filled in (#4949 reported `entityId=p:0`). The query engine\n  // falls back to a pluralized table-name guess for ids it cannot resolve, so such a lookup used\n  // to reach Postgres as `select ... from \"0s\"` and escape this handler as an unhandled 500 on\n  // every render of the section holding the field. Resolve the id first and answer with an empty\n  // option list instead, mirroring the empty-`entityId` contract above.\n  if (!customEntity && resolveRegisteredEntityTableName(em, entityId) === null) {\n    logger.warn('Relation options requested for an unresolvable entity id', { entityId })\n    return NextResponse.json({ items: [] })\n  }\n\n  if (!labelField) labelField = (customEntity?.labelField as string | undefined) || ''\n  if (!labelField) {\n    const candidates = ['name', 'title', 'code', 'email']\n    const table = tableNameFromEntityId(entityId)\n    const db = (em as any).getKysely() as any\n    for (const c of candidates) {\n      const exists = await db\n        .selectFrom('information_schema.columns')\n        .select('column_name')\n        .where('table_name', '=', table)\n        .where('column_name', '=', c)\n        .executeTakeFirst()\n      if (exists) { labelField = c; break }\n    }\n    if (!labelField) labelField = 'id'\n  }\n  const filters: Record<string, unknown> = {}\n  if (ids.length === 1) filters.id = ids[0]\n  else if (ids.length > 1) filters.id = { $in: ids }\n  if (q) filters[labelField] = { $ilike: `%${escapeLikePattern(q)}%` }\n  const fields = Array.from(new Set(['id', labelField, ...routeContextFields]))\n  const res = await qe.query(entityId, {\n    tenantId: auth.tenantId ?? undefined,\n    ...(auth.orgId ? { organizationId: auth.orgId } : {}),\n    fields,\n    filters,\n    page: { page: 1, pageSize: Math.min(ids.length || 50, 200) },\n  })\n  const items = (res.items || []).map((it: any) => {\n    const routeContext = routeContextFields.reduce<Record<string, unknown>>((acc, field) => {\n      if (it[field] !== undefined) {\n        acc[field] = it[field]\n      }\n      return acc\n    }, {})\n    return {\n      value: String(it.id),\n      label: String(it[labelField] ?? it.id),\n      ...(Object.keys(routeContext).length > 0 ? { routeContext } : {}),\n    }\n  })\n  return NextResponse.json({ items })\n}\n\nconst relationOptionsQuerySchema = z.object({\n  entityId: z.string().min(1),\n  labelField: z.string().optional(),\n  q: z.string().optional(),\n  ids: z.string().optional(),\n  routeContextFields: z.string().optional(),\n})\n\nconst relationOptionsResponseSchema = z.object({\n  items: z.array(\n    z.object({\n      value: z.string(),\n      label: z.string(),\n      routeContext: z.record(z.string(), z.unknown()).optional(),\n    })\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Relation options lookup',\n  methods: {\n    GET: {\n      summary: 'List relation options',\n      description: 'Returns up to 200 option entries for populating relation dropdowns, automatically resolving label fields when omitted. An entityId that matches neither an active custom entity nor a registered ORM entity yields an empty option list.',\n      query: relationOptionsQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Option list',\n          schema: relationOptionsResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAI7B,SAAS,yBAAyB;AAClC,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAEtB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC3E;AAEA,MAAM,+BAA+B,oBAAI,IAAI,CAAC,QAAQ,aAAa,YAAY,CAAC;AAEhF,MAAM,SAAS,aAAa,UAAU;AAEtC,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,aAAa,IAAI,UAAU,KAAK;AACrD,MAAI,aAAa,IAAI,aAAa,IAAI,YAAY,KAAK;AACvD,QAAM,IAAI,IAAI,aAAa,IAAI,GAAG,KAAK;AACvC,QAAM,MAAM,MAAM;AAAA,IAChB,IAAI;AAAA,OACD,IAAI,aAAa,IAAI,KAAK,KAAK,IAC7B,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AAAA,IACvC;AAAA,EACF;AACA,QAAM,qBAAqB,MAAM;AAAA,IAC/B,IAAI;AAAA,OACD,IAAI,aAAa,IAAI,oBAAoB,KAAK,IAC5C,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,6BAA6B,IAAI,KAAK,CAAC;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAErD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,aAAa;AAC1C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,eAAe,MAAM,GAAG,QAAQ,cAAc;AAAA,IAClD;AAAA,IACA,MAAM;AAAA,MACJ,EAAE,KAAK,CAAE,EAAE,gBAAgB,KAAK,SAAS,OAAiB,GAAG,EAAE,gBAAgB,KAAK,CAAE,EAAE;AAAA,MACxF,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,IACjF;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AAQD,MAAI,CAAC,gBAAgB,iCAAiC,IAAI,QAAQ,MAAM,MAAM;AAC5E,WAAO,KAAK,4DAA4D,EAAE,SAAS,CAAC;AACpF,WAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAAA,EACxC;AAEA,MAAI,CAAC,WAAY,cAAc,cAAc,cAAqC;AAClF,MAAI,CAAC,YAAY;AACf,UAAM,aAAa,CAAC,QAAQ,SAAS,QAAQ,OAAO;AACpD,UAAM,QAAQ,sBAAsB,QAAQ;AAC5C,UAAM,KAAM,GAAW,UAAU;AACjC,eAAW,KAAK,YAAY;AAC1B,YAAM,SAAS,MAAM,GAClB,WAAW,4BAA4B,EACvC,OAAO,aAAa,EACpB,MAAM,cAAc,KAAK,KAAK,EAC9B,MAAM,eAAe,KAAK,CAAC,EAC3B,iBAAiB;AACpB,UAAI,QAAQ;AAAE,qBAAa;AAAG;AAAA,MAAM;AAAA,IACtC;AACA,QAAI,CAAC,WAAY,cAAa;AAAA,EAChC;AACA,QAAM,UAAmC,CAAC;AAC1C,MAAI,IAAI,WAAW,EAAG,SAAQ,KAAK,IAAI,CAAC;AAAA,WAC/B,IAAI,SAAS,EAAG,SAAQ,KAAK,EAAE,KAAK,IAAI;AACjD,MAAI,EAAG,SAAQ,UAAU,IAAI,EAAE,QAAQ,IAAI,kBAAkB,CAAC,CAAC,IAAI;AACnE,QAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC;AAC5E,QAAM,MAAM,MAAM,GAAG,MAAM,UAAU;AAAA,IACnC,UAAU,KAAK,YAAY;AAAA,IAC3B,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;AAAA,IACnD;AAAA,IACA;AAAA,IACA,MAAM,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,GAAG,EAAE;AAAA,EAC7D,CAAC;AACD,QAAM,SAAS,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,OAAY;AAC/C,UAAM,eAAe,mBAAmB,OAAgC,CAAC,KAAK,UAAU;AACtF,UAAI,GAAG,KAAK,MAAM,QAAW;AAC3B,YAAI,KAAK,IAAI,GAAG,KAAK;AAAA,MACvB;AACA,aAAO;AAAA,IACT,GAAG,CAAC,CAAC;AACL,WAAO;AAAA,MACL,OAAO,OAAO,GAAG,EAAE;AAAA,MACnB,OAAO,OAAO,GAAG,UAAU,KAAK,GAAG,EAAE;AAAA,MACrC,GAAI,OAAO,KAAK,YAAY,EAAE,SAAS,IAAI,EAAE,aAAa,IAAI,CAAC;AAAA,IACjE;AAAA,EACF,CAAC;AACD,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,GAAG,EAAE,OAAO,EAAE,SAAS;AAAA,EACvB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAC1C,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,OAAO,EAAE,OAAO;AAAA,MAChB,OAAO,EAAE,OAAO;AAAA,MAChB,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC3D,CAAC;AAAA,EACH;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/api/sidebar-entities.js

@@ -3,9 +3,8 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { CustomEntity } from "@open-mercato/core/modules/entities/data/entities";
-import { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from "../lib/entityAcl.js";
 const metadata = {
-  GET: { requireAuth: true, requireFeatures: ["entities.records.view"] }
+  GET: { requireAuth: true }
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
@@ -13,11 +12,6 @@ async function GET(req) {
   const { resolve } = await createRequestContainer();
   const em = resolve("em");
   const cache = resolve("cache");
-  const rbac = resolve("rbacService");
-  const acl = await rbac.loadAcl(auth.sub ?? "", {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId ?? null
-  });
   const where = {
     isActive: true,
     showInSidebar: true
@@ -26,41 +20,25 @@ async function GET(req) {
     //    { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant
     { $or: [{ tenantId: auth.tenantId ?? void 0 }, { tenantId: null }] }
   ];
-  const cacheKey = `entities:sidebar:v2:${auth.tenantId || "null"}`;
-  let candidates = null;
+  const cacheKey = `entities:sidebar:${auth.tenantId || "null"}`;
   try {
     if (cache) {
       const cached = await cache.get(cacheKey);
-      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates;
+      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached);
     }
   } catch {
   }
-  if (!candidates) {
-    const entities = await em.find(CustomEntity, where, { orderBy: { label: "asc" } });
-    candidates = entities.map((entity) => ({
-      entityId: entity.entityId,
-      label: entity.label,
-      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,
-      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId) ?? entity.accessRestricted === true
-    }));
-    try {
-      if (cache) {
-        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || "null"}`] });
-      }
-    } catch {
-    }
-  }
-  const items = candidates.filter((entity) => canReadEntityMetadata({
-    entityId: entity.entityId,
-    isCustomEntity: true,
-    isRestricted: entity.accessRestricted,
-    acl
-  })).map((entity) => ({
-    entityId: entity.entityId,
-    label: entity.label,
-    href: entity.href
+  const entities = await em.find(CustomEntity, where, { orderBy: { label: "asc" } });
+  const items = entities.map((e) => ({
+    entityId: e.entityId,
+    label: e.label,
+    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`
   }));
   const payload = { items };
+  try {
+    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || "null"}`] });
+  } catch {
+  }
   return NextResponse.json(payload);
 }
 const sidebarEntitiesResponseSchema = z.object({

package/dist/modules/entities/api/sidebar-entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/sidebar-entities.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { EntityManager } from '@mikro-orm/core'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { canReadEntityMetadata, getDeclaredCustomEntityRestriction } from '../lib/entityAcl'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.records.view'] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const cache = resolve('cache') as any\n  const rbac = resolve('rbacService') as RbacService\n  const acl = await rbac.loadAcl(auth.sub ?? '', {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId ?? null,\n  })\n\n  const where: any = { \n    isActive: true,\n    showInSidebar: true\n  }\n  where.$and = [\n//    { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant\n    { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n  ]\n  \n  const cacheKey = `entities:sidebar:v2:${auth.tenantId || 'null'}`\n  let candidates: Array<{\n    entityId: string\n    label: string\n    href: string\n    accessRestricted: boolean\n  }> | null = null\n  try {\n    if (cache) {\n      const cached = await cache.get(cacheKey)\n      if (cached && Array.isArray(cached.candidates)) candidates = cached.candidates\n    }\n  } catch {}\n\n  if (!candidates) {\n    const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })\n    candidates = (entities as any[]).map((entity) => ({\n      entityId: entity.entityId,\n      label: entity.label,\n      href: `/backend/entities/user/${encodeURIComponent(entity.entityId)}/records`,\n      accessRestricted: getDeclaredCustomEntityRestriction(entity.entityId)\n        ?? entity.accessRestricted === true,\n    }))\n    try {\n      if (cache) {\n        await cache.set(cacheKey, { candidates }, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })\n      }\n    } catch {}\n  }\n\n  const items = candidates\n    .filter((entity) => canReadEntityMetadata({\n      entityId: entity.entityId,\n      isCustomEntity: true,\n      isRestricted: entity.accessRestricted,\n      acl,\n    }))\n    .map((entity) => ({\n      entityId: entity.entityId,\n      label: entity.label,\n      href: entity.href,\n    }))\n  const payload = { items }\n  return NextResponse.json(payload)\n}\n\nconst sidebarEntitiesResponseSchema = z.object({\n  items: z.array(\n    z.object({\n      entityId: z.string(),\n      label: z.string(),\n      href: z.string(),\n    })\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'List sidebar entities',\n  methods: {\n    GET: {\n      summary: 'Get sidebar entities',\n      description: 'Returns custom entities flagged with `showInSidebar` for the current tenant/org scope.',\n      responses: [\n        {\n          status: 200,\n          description: 'Sidebar entities for navigation',\n          schema: sidebarEntitiesResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAG7B,SAAS,uBAAuB,0CAA0C;AAEnE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEvI,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,QAAQ,QAAQ,OAAO;AAC7B,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,OAAO,IAAI;AAAA,IAC7C,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,SAAS;AAAA,EAChC,CAAC;AAED,QAAM,QAAa;AAAA,IACjB,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACA,QAAM,OAAO;AAAA;AAAA,IAEX,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,EACjF;AAEA,QAAM,WAAW,uBAAuB,KAAK,YAAY,MAAM;AAC/D,MAAI,aAKQ;AACZ,MAAI;AACF,QAAI,OAAO;AACT,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,UAAU,MAAM,QAAQ,OAAO,UAAU,EAAG,cAAa,OAAO;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAAC;AAET,MAAI,CAAC,YAAY;AACf,UAAM,WAAW,MAAM,GAAG,KAAK,cAAqB,OAAc,EAAE,SAAS,EAAE,OAAO,MAAM,EAAS,CAAC;AACtG,iBAAc,SAAmB,IAAI,CAAC,YAAY;AAAA,MAChD,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO;AAAA,MACd,MAAM,0BAA0B,mBAAmB,OAAO,QAAQ,CAAC;AAAA,MACnE,kBAAkB,mCAAmC,OAAO,QAAQ,KAC/D,OAAO,qBAAqB;AAAA,IACnC,EAAE;AACF,QAAI;AACF,UAAI,OAAO;AACT,cAAM,MAAM,IAAI,UAAU,EAAE,WAAW,GAAG,EAAE,MAAM,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,EAAE,CAAC;AAAA,MACjG;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,WACX,OAAO,CAAC,WAAW,sBAAsB;AAAA,IACxC,UAAU,OAAO;AAAA,IACjB,gBAAgB;AAAA,IAChB,cAAc,OAAO;AAAA,IACrB;AAAA,EACF,CAAC,CAAC,EACD,IAAI,CAAC,YAAY;AAAA,IAChB,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO;AAAA,IACd,MAAM,OAAO;AAAA,EACf,EAAE;AACJ,QAAM,UAAU,EAAE,MAAM;AACxB,SAAO,aAAa,KAAK,OAAO;AAClC;AAEA,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO;AAAA,MACnB,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { EntityManager } from '@mikro-orm/core'\nimport { CustomEntity } from '@open-mercato/core/modules/entities/data/entities'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const cache = resolve('cache') as any\n\n  const where: any = { \n    isActive: true,\n    showInSidebar: true\n  }\n  where.$and = [\n//    { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant\n    { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n  ]\n  \n  // Try cache first to avoid repeated queries on focus refreshes\n  const cacheKey = `entities:sidebar:${auth.tenantId || 'null'}`\n  try {\n    if (cache) {\n      const cached = await cache.get(cacheKey)\n      if (cached && Array.isArray(cached.items)) return NextResponse.json(cached)\n    }\n  } catch {}\n\n  const entities = await em.find(CustomEntity as any, where as any, { orderBy: { label: 'asc' } as any })\n  \n  const items = (entities as any[]).map((e) => ({\n    entityId: e.entityId,\n    label: e.label,\n    href: `/backend/entities/user/${encodeURIComponent(e.entityId)}/records`\n  }))\n\n  const payload = { items }\n  try {\n    if (cache) await cache.set(cacheKey, payload, { tags: [`nav:entities:${auth.tenantId || 'null'}`] })\n  } catch {}\n  return NextResponse.json(payload)\n}\n\nconst sidebarEntitiesResponseSchema = z.object({\n  items: z.array(\n    z.object({\n      entityId: z.string(),\n      label: z.string(),\n      href: z.string(),\n    })\n  ),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'List sidebar entities',\n  methods: {\n    GET: {\n      summary: 'Get sidebar entities',\n      description: 'Returns custom entities flagged with `showInSidebar` for the current tenant/org scope.',\n      responses: [\n        {\n          status: 200,\n          description: 'Sidebar entities for navigation',\n          schema: sidebarEntitiesResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAGtB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEvI,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,QAAQ,QAAQ,OAAO;AAE7B,QAAM,QAAa;AAAA,IACjB,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AACA,QAAM,OAAO;AAAA;AAAA,IAEX,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,EACjF;AAGA,QAAM,WAAW,oBAAoB,KAAK,YAAY,MAAM;AAC5D,MAAI;AACF,QAAI,OAAO;AACT,YAAM,SAAS,MAAM,MAAM,IAAI,QAAQ;AACvC,UAAI,UAAU,MAAM,QAAQ,OAAO,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM;AAAA,IAC5E;AAAA,EACF,QAAQ;AAAA,EAAC;AAET,QAAM,WAAW,MAAM,GAAG,KAAK,cAAqB,OAAc,EAAE,SAAS,EAAE,OAAO,MAAM,EAAS,CAAC;AAEtG,QAAM,QAAS,SAAmB,IAAI,CAAC,OAAO;AAAA,IAC5C,UAAU,EAAE;AAAA,IACZ,OAAO,EAAE;AAAA,IACT,MAAM,0BAA0B,mBAAmB,EAAE,QAAQ,CAAC;AAAA,EAChE,EAAE;AAEF,QAAM,UAAU,EAAE,MAAM;AACxB,MAAI;AACF,QAAI,MAAO,OAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,EAAE,CAAC;AAAA,EACrG,QAAQ;AAAA,EAAC;AACT,SAAO,aAAa,KAAK,OAAO;AAClC;AAEA,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE;AAAA,IACP,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,OAAO;AAAA,MACnB,OAAO,EAAE,OAAO;AAAA,MAChB,MAAM,EAAE,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACF,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/backend/entities/user/[entityId]/records/page.js

@@ -1,8 +1,6 @@
 "use client";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
-import { resolveExtensionPointPattern } from "@open-mercato/shared/modules/widgets/extension-points";
-import { extensionPoints } from "@open-mercato/core/modules/entities/extension-points";
 import { filterCustomFieldDefs, useCustomFieldDefs } from "@open-mercato/ui/backend/utils/customFieldDefs";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
@@ -20,11 +18,6 @@ import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuarde
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { ErrorMessage, LoadingMessage } from "@open-mercato/ui/backend/detail";
 import { useRecordsEntityGuard } from "@open-mercato/core/modules/entities/components/useRecordsEntityGuard";
-import {
-  RelationCell,
-  RelationDisplaysProvider,
-  useRecordListRelationDisplays
-} from "@open-mercato/core/modules/entities/components/RecordListRelationCell";
 function toCsvUrl(base, params) {
   const p = new URLSearchParams(params);
   p.set("format", "csv");
@@ -72,13 +65,6 @@ function RecordsPageInner({ params }) {
     enabled: Boolean(entityId),
     keyExtras: [scopeVersion]
   });
-  const relationDefinitions = React.useMemo(
-    () => filterCustomFieldDefs(cfDefs, "list").filter(
-      (definition) => definition.kind === "relation"
-    ),
-    [cfDefs]
-  );
-  const relationDisplaysByField = useRecordListRelationDisplays(relationDefinitions, rawData);
   const searchableFields = React.useMemo(() => {
     const fields = (columns || []).map((col) => col.accessorKey).filter((key) => typeof key === "string" && key.length > 0);
     return Array.from(/* @__PURE__ */ new Set(["id", ...fields]));
@@ -154,10 +140,7 @@ function RecordsPageInner({ params }) {
       meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },
       cell: ({ getValue }) => {
         const v = getValue();
-        if (d.kind === "relation") {
-          return /* @__PURE__ */ jsx(RelationCell, { fieldKey: d.key, value: v, fallbackText: normalizeCell(v) });
-        }
-        return /* @__PURE__ */ jsx("span", { className: "inline-block max-w-60 truncate align-top", title: normalizeCell(v), children: normalizeCell(v) });
+        return /* @__PURE__ */ jsx("span", { className: "truncate max-w-[24ch] inline-block align-top", title: normalizeCell(v), children: normalizeCell(v) });
       }
     }));
     const hasIdCol = cols.some((c) => c.accessorKey === "id" || c.id === "id");
@@ -312,7 +295,7 @@ export RECORD_ID="<record uuid>"` }) }),
           ] })
         ] })
       ] }),
-      /* @__PURE__ */ jsx(RelationDisplaysProvider, { displaysByField: relationDisplaysByField, children: /* @__PURE__ */ jsx(
+      /* @__PURE__ */ jsx(
         DataTable,
         {
           stickyActionsColumn: true,
@@ -321,9 +304,7 @@ export RECORD_ID="<record uuid>"` }) }),
           actions,
           columns,
           data,
-          perspective: {
-            tableId: resolveExtensionPointPattern(extensionPoints.hosts.userRecordsTable.pattern, { entityId })
-          },
+          perspective: { tableId: `entities.user.records.${entityId}` },
           exporter: exportConfig,
           filters: baseFilters,
           filterValues,
@@ -399,7 +380,7 @@ export RECORD_ID="<record uuid>"` }) }),
           pagination: { page, pageSize, total, totalPages, onPageChange: setPage },
           isLoading: loading
         }
-      ) })
+      )
     ] }),
     ConfirmDialogElement
   ] });