@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/dist/modules/attachments/di.js

@@ -1,13 +1,7 @@
-import { asFunction, asValue } from "awilix";
+import { asFunction } from "awilix";
 import { StorageDriverFactory } from "./lib/drivers/driverFactory.js";
-import { createAttachmentQuotaService } from "./lib/quota-service.js";
-import { scheduleAttachmentQuotaRecovery } from "./lib/quota-recovery-queue.js";
 function register(container) {
   container.register({
-    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),
-    attachmentQuotaService: asFunction(
-      ({ em }) => createAttachmentQuotaService(em)
-    ).scoped().proxy(),
     storageDriverFactory: asFunction(
       ({ em }) => new StorageDriverFactory(em)
     ).singleton().proxy()

package/dist/modules/attachments/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/di.ts"],
-  "sourcesContent": ["import { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\nimport { createAttachmentQuotaService } from './lib/quota-service'\nimport { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'\n\nexport function register(container: AppContainer) {\n  container.register({\n    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),\n    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      createAttachmentQuotaService(em),\n    )\n      .scoped()\n      .proxy(),\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,eAAe;AAEpC,SAAS,4BAA4B;AACrC,SAAS,oCAAoC;AAC7C,SAAS,uCAAuC;AAEzC,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS;AAAA,IACjB,kCAAkC,QAAQ,+BAA+B;AAAA,IACzE,wBAAwB;AAAA,MAAW,CAAC,EAAE,GAAG,MACvC,6BAA6B,EAAE;AAAA,IACjC,EACG,OAAO,EACP,MAAM;AAAA,IACT,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA,EACX,CAAC;AACH;",
+  "sourcesContent": ["import { asFunction } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\n\nexport function register(container: AppContainer) {\n  container.register({\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,4BAA4B;AAE9B,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS;AAAA,IACjB,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA,EACX,CAAC;AACH;",
   "names": []
 }

package/dist/modules/attachments/fields/attachment.js

@@ -138,7 +138,7 @@ const AttachmentInput = ({
         }
       )
     ] }),
-    error ? /* @__PURE__ */ jsx("div", { className: "text-xs text-status-error-text", children: error }) : null,
+    error ? /* @__PURE__ */ jsx("div", { className: "text-xs text-red-600", children: error }) : null,
     /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
       loading ? /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground", children: t("attachments.library.loading", "Loading attachments\u2026") }) : null,
       items.map((it) => /* @__PURE__ */ jsxs("div", { className: "text-sm", children: [

package/dist/modules/attachments/fields/attachment.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/fields/attachment.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { FieldRegistry } from '@open-mercato/ui/backend/fields/registry'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type { CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Upload } from 'lucide-react'\n\nfunction humanSize(n: number): string {\n  if (!Number.isFinite(n)) return String(n)\n  const units = ['B','KB','MB','GB']\n  let i = 0\n  let x = n\n  while (x >= 1024 && i < units.length - 1) { x /= 1024; i++ }\n  return `${x.toFixed(i === 0 ? 0 : 1)} ${units[i]}`\n}\n\ntype AttachmentsResponse = {\n  items?: Array<{ id: string; url: string; fileName: string; fileSize: number }>\n  error?: string\n}\n\ntype AttachmentFieldDef = CustomFieldDefDto & {\n  configJson?: {\n    maxAttachmentSizeMb?: number\n    acceptExtensions?: string[]\n    partitionCode?: string\n  }\n}\n\ntype AttachmentDefEditorPatch = {\n  maxAttachmentSizeMb?: number\n  acceptExtensions?: string[]\n  partitionCode?: string\n}\n\nfunction buildAcceptAttribute(def?: AttachmentFieldDef): string | undefined {\n  if (!Array.isArray(def?.acceptExtensions) || def.acceptExtensions.length === 0) return undefined\n  const values = def.acceptExtensions\n    .map((entry) => String(entry ?? '').trim().replace(/^\\./, ''))\n    .filter((entry) => entry.length > 0)\n  if (values.length === 0) return undefined\n  return values.map((entry) => `.${entry}`).join(',')\n}\n\nexport const AttachmentInput = ({\n  entityId,\n  recordId,\n  def,\n  disabled,\n}: {\n  entityId?: string\n  recordId?: string\n  def?: AttachmentFieldDef\n  disabled?: boolean\n}) => {\n  const t = useT()\n  const [items, setItems] = React.useState<Array<{ id: string; url: string; fileName: string; fileSize: number }>>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const [uploading, setUploading] = React.useState(false)\n  const fileInputRef = React.useRef<HTMLInputElement | null>(null)\n  const accept = React.useMemo(() => buildAcceptAttribute(def), [def])\n\n  const load = React.useCallback(async () => {\n    if (!entityId || !recordId) return\n    try {\n      setLoading(true)\n      const call = await apiCall<AttachmentsResponse>(\n        `/api/attachments?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,\n        undefined,\n        { fallback: { items: [] } },\n      )\n      if (!call.ok) {\n        const message = call.result?.error || t('attachments.library.errors.load', 'Failed to load attachments.')\n        throw new Error(message)\n      }\n      const j = call.result ?? { items: [] }\n      setItems(Array.isArray(j.items) ? j.items : [])\n    } catch (error: unknown) {\n      setError(error instanceof Error ? error.message : t('attachments.library.errors.load', 'Failed to load attachments.'))\n    } finally {\n      setLoading(false)\n    }\n  }, [entityId, recordId, t])\n\n  React.useEffect(() => { load() }, [load])\n\n  const onUpload = async (files: FileList | null) => {\n    if (!files || !entityId || !recordId) return\n    setError(null)\n    setUploading(true)\n    try {\n      for (const file of Array.from(files)) {\n        const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n        const acceptExtensions = Array.isArray(def?.acceptExtensions) ? def.acceptExtensions : []\n        if (acceptExtensions.length > 0) {\n          const allowed = new Set(acceptExtensions.map((entry) => String(entry).toLowerCase().replace(/^\\./, '')))\n          if (!allowed.has(ext)) { setError('File type not allowed'); continue }\n        }\n        const maxAttachmentSizeMb = typeof def?.maxAttachmentSizeMb === 'number' ? def.maxAttachmentSizeMb : undefined\n        if (typeof maxAttachmentSizeMb === 'number' && maxAttachmentSizeMb > 0) {\n          const maxBytes = Math.floor(maxAttachmentSizeMb * 1024 * 1024)\n          if (file.size > maxBytes) { setError(`File exceeds ${maxAttachmentSizeMb} MB limit`); continue }\n        }\n        const fd = new FormData()\n        fd.set('entityId', entityId)\n        fd.set('recordId', recordId)\n        if (def?.key) fd.set('fieldKey', String(def.key))\n        fd.set('file', file)\n        const call = await apiCall<{ error?: string }>(\n          '/api/attachments',\n          { method: 'POST', body: fd },\n          { fallback: null },\n        )\n        if (!call.ok) {\n          setError(call.result?.error || t('attachments.library.upload.failed', 'Upload failed.'))\n          break\n        }\n      }\n      await load()\n    } finally {\n      setUploading(false)\n      if (fileInputRef.current) {\n        fileInputRef.current.value = ''\n      }\n    }\n  }\n\n  return (\n    <div className=\"space-y-3\">\n      {!entityId || !recordId ? (\n        <div className=\"rounded-md border border-dashed border-border/70 px-3 py-4 text-sm text-muted-foreground\">\n          {t('attachments.library.upload.saveFirst', 'Save the record before uploading files.')}\n        </div>\n      ) : (\n        <div className=\"rounded-md border border-dashed border-border/70 bg-muted/30 px-4 py-4\">\n          <div className=\"flex flex-wrap items-center gap-3\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => fileInputRef.current?.click()}\n              disabled={disabled || uploading}\n            >\n              <Upload className=\"h-4 w-4\" />\n              {uploading\n                ? t('attachments.library.upload.submitting', 'Uploading\u2026')\n                : t('attachments.library.upload.choose', 'Choose files')}\n            </Button>\n          </div>\n          <input\n            ref={fileInputRef}\n            type=\"file\"\n            multiple\n            className=\"hidden\"\n            accept={accept}\n            disabled={disabled || uploading}\n            onChange={(event) => { void onUpload(event.target.files) }}\n          />\n        </div>\n      )}\n      {error ? <div className=\"text-xs text-status-error-text\">{error}</div> : null}\n      <div className=\"space-y-1\">\n        {loading ? <div className=\"text-xs text-muted-foreground\">{t('attachments.library.loading', 'Loading attachments\u2026')}</div> : null}\n        {items.map(it => (\n          <div key={it.id} className=\"text-sm\">\n            <a className=\"underline\" href={it.url} target=\"_blank\" rel=\"noreferrer\">{it.fileName}</a>\n            <span className=\"text-xs text-muted-foreground\"> \u2022 {humanSize(it.fileSize)}</span>\n          </div>\n        ))}\n        {!loading && items.length === 0 ? <div className=\"text-xs text-muted-foreground\">{t('attachments.library.table.empty', 'No attachments found.')}</div> : null}\n      </div>\n    </div>\n  )\n}\n\n// Register with field registry under kind 'attachment'\nfunction AttachmentDefEditor({ def, onChange }: { def: AttachmentFieldDef; onChange: (patch: AttachmentDefEditorPatch) => void }) {\n  const cfg = def?.configJson || {}\n  const [maxMb, setMaxMb] = React.useState<number | ''>(typeof cfg.maxAttachmentSizeMb === 'number' ? cfg.maxAttachmentSizeMb : '')\n  const [exts, setExts] = React.useState<string>((Array.isArray(cfg.acceptExtensions) ? cfg.acceptExtensions : []).join(', '))\n  const [partition, setPartition] = React.useState<string>(typeof cfg.partitionCode === 'string' ? cfg.partitionCode : '')\n  return (\n    <div className=\"grid grid-cols-1 gap-3 md:grid-cols-2\">\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Max file size (MB)</label>\n        <Input\n          type=\"number\"\n          min={0}\n          placeholder=\"e.g., 10\"\n          value={maxMb}\n          onChange={(e) => setMaxMb(e.target.value === '' ? '' : Number(e.target.value))}\n          onBlur={() => onChange({ maxAttachmentSizeMb: maxMb === '' ? undefined : Number(maxMb) })}\n        />\n      </div>\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Accepted extensions</label>\n        <Input\n          placeholder=\"e.g., pdf, jpg, png\"\n          value={exts}\n          onChange={(e) => setExts(e.target.value)}\n          onBlur={() => onChange({ acceptExtensions: exts.split(',').map((s) => s.trim()).filter(Boolean) })}\n        />\n        <div className=\"text-xs text-muted-foreground\">Leave blank to allow any.</div>\n      </div>\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Partition code</label>\n        <Input\n          placeholder=\"e.g., productsMedia\"\n          value={partition}\n          onChange={(e) => setPartition(e.target.value)}\n          onBlur={() => onChange({ partitionCode: partition.trim() || undefined })}\n        />\n        <div className=\"text-xs text-muted-foreground\">\n          Configure partitions under Settings \u2192 Attachments. Leave blank for default.\n        </div>\n      </div>\n    </div>\n  )\n}\n\nFieldRegistry.register('attachment', {\n  input: (props) => <AttachmentInput entityId={props.entityId} recordId={props.recordId} def={props.def} disabled={props.disabled} />,\n  defEditor: (p) => <AttachmentDefEditor {...p} />,\n})\n\nexport {}\n"],
-  "mappings": ";AAsIQ,cAMI,YANJ;AArIR,YAAY,WAAW;AACvB,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAExB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,cAAc;AAEvB,SAAS,UAAU,GAAmB;AACpC,MAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO,OAAO,CAAC;AACxC,QAAM,QAAQ,CAAC,KAAI,MAAK,MAAK,IAAI;AACjC,MAAI,IAAI;AACR,MAAI,IAAI;AACR,SAAO,KAAK,QAAQ,IAAI,MAAM,SAAS,GAAG;AAAE,SAAK;AAAM;AAAA,EAAI;AAC3D,SAAO,GAAG,EAAE,QAAQ,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAClD;AAqBA,SAAS,qBAAqB,KAA8C;AAC1E,MAAI,CAAC,MAAM,QAAQ,KAAK,gBAAgB,KAAK,IAAI,iBAAiB,WAAW,EAAG,QAAO;AACvF,QAAM,SAAS,IAAI,iBAChB,IAAI,CAAC,UAAU,OAAO,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,OAAO,EAAE,CAAC,EAC5D,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,OAAO,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,EAAE,KAAK,GAAG;AACpD;AAEO,MAAM,kBAAkB,CAAC;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAKM;AACJ,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAiF,CAAC,CAAC;AACnH,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,eAAe,MAAM,OAAgC,IAAI;AAC/D,QAAM,SAAS,MAAM,QAAQ,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,CAAC;AAEnE,QAAM,OAAO,MAAM,YAAY,YAAY;AACzC,QAAI,CAAC,YAAY,CAAC,SAAU;AAC5B,QAAI;AACF,iBAAW,IAAI;AACf,YAAM,OAAO,MAAM;AAAA,QACjB,6BAA6B,mBAAmB,QAAQ,CAAC,aAAa,mBAAmB,QAAQ,CAAC;AAAA,QAClG;AAAA,QACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,MAC5B;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,UAAU,KAAK,QAAQ,SAAS,EAAE,mCAAmC,6BAA6B;AACxG,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AACA,YAAM,IAAI,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AACrC,eAAS,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,IAChD,SAASA,QAAgB;AACvB,eAASA,kBAAiB,QAAQA,OAAM,UAAU,EAAE,mCAAmC,6BAA6B,CAAC;AAAA,IACvH,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,UAAU,UAAU,CAAC,CAAC;AAE1B,QAAM,UAAU,MAAM;AAAE,SAAK;AAAA,EAAE,GAAG,CAAC,IAAI,CAAC;AAExC,QAAM,WAAW,OAAO,UAA2B;AACjD,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAU;AACtC,aAAS,IAAI;AACb,iBAAa,IAAI;AACjB,QAAI;AACF,iBAAW,QAAQ,MAAM,KAAK,KAAK,GAAG;AACpC,cAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,cAAM,mBAAmB,MAAM,QAAQ,KAAK,gBAAgB,IAAI,IAAI,mBAAmB,CAAC;AACxF,YAAI,iBAAiB,SAAS,GAAG;AAC/B,gBAAM,UAAU,IAAI,IAAI,iBAAiB,IAAI,CAAC,UAAU,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACvG,cAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AAAE,qBAAS,uBAAuB;AAAG;AAAA,UAAS;AAAA,QACvE;AACA,cAAM,sBAAsB,OAAO,KAAK,wBAAwB,WAAW,IAAI,sBAAsB;AACrG,YAAI,OAAO,wBAAwB,YAAY,sBAAsB,GAAG;AACtE,gBAAM,WAAW,KAAK,MAAM,sBAAsB,OAAO,IAAI;AAC7D,cAAI,KAAK,OAAO,UAAU;AAAE,qBAAS,gBAAgB,mBAAmB,WAAW;AAAG;AAAA,UAAS;AAAA,QACjG;AACA,cAAM,KAAK,IAAI,SAAS;AACxB,WAAG,IAAI,YAAY,QAAQ;AAC3B,WAAG,IAAI,YAAY,QAAQ;AAC3B,YAAI,KAAK,IAAK,IAAG,IAAI,YAAY,OAAO,IAAI,GAAG,CAAC;AAChD,WAAG,IAAI,QAAQ,IAAI;AACnB,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,QAAQ,MAAM,GAAG;AAAA,UAC3B,EAAE,UAAU,KAAK;AAAA,QACnB;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,mBAAS,KAAK,QAAQ,SAAS,EAAE,qCAAqC,gBAAgB,CAAC;AACvF;AAAA,QACF;AAAA,MACF;AACA,YAAM,KAAK;AAAA,IACb,UAAE;AACA,mBAAa,KAAK;AAClB,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,KAAC,YAAY,CAAC,WACb,oBAAC,SAAI,WAAU,4FACZ,YAAE,wCAAwC,yCAAyC,GACtF,IAEA,qBAAC,SAAI,WAAU,0EACb;AAAA,0BAAC,SAAI,WAAU,qCACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,aAAa,SAAS,MAAM;AAAA,UAC3C,UAAU,YAAY;AAAA,UAEtB;AAAA,gCAAC,UAAO,WAAU,WAAU;AAAA,YAC3B,YACG,EAAE,yCAAyC,iBAAY,IACvD,EAAE,qCAAqC,cAAc;AAAA;AAAA;AAAA,MAC3D,GACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,UAAQ;AAAA,UACR,WAAU;AAAA,UACV;AAAA,UACA,UAAU,YAAY;AAAA,UACtB,UAAU,CAAC,UAAU;AAAE,iBAAK,SAAS,MAAM,OAAO,KAAK;AAAA,UAAE;AAAA;AAAA,MAC3D;AAAA,OACF;AAAA,IAED,QAAQ,oBAAC,SAAI,WAAU,kCAAkC,iBAAM,IAAS;AAAA,IACzE,qBAAC,SAAI,WAAU,aACZ;AAAA,gBAAU,oBAAC,SAAI,WAAU,iCAAiC,YAAE,+BAA+B,2BAAsB,GAAE,IAAS;AAAA,MAC5H,MAAM,IAAI,QACT,qBAAC,SAAgB,WAAU,WACzB;AAAA,4BAAC,OAAE,WAAU,aAAY,MAAM,GAAG,KAAK,QAAO,UAAS,KAAI,cAAc,aAAG,UAAS;AAAA,QACrF,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,UAAI,UAAU,GAAG,QAAQ;AAAA,WAAE;AAAA,WAFnE,GAAG,EAGb,CACD;AAAA,MACA,CAAC,WAAW,MAAM,WAAW,IAAI,oBAAC,SAAI,WAAU,iCAAiC,YAAE,mCAAmC,uBAAuB,GAAE,IAAS;AAAA,OAC3J;AAAA,KACF;AAEJ;AAGA,SAAS,oBAAoB,EAAE,KAAK,SAAS,GAAqF;AAChI,QAAM,MAAM,KAAK,cAAc,CAAC;AAChC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAsB,OAAO,IAAI,wBAAwB,WAAW,IAAI,sBAAsB,EAAE;AAChI,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,UAAkB,MAAM,QAAQ,IAAI,gBAAgB,IAAI,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC;AAC3H,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAiB,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB,EAAE;AACvH,SACE,qBAAC,SAAI,WAAU,yCACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,gCAAkB;AAAA,MACzD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,KAAK;AAAA,UACL,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,UAAU,KAAK,KAAK,OAAO,EAAE,OAAO,KAAK,CAAC;AAAA,UAC7E,QAAQ,MAAM,SAAS,EAAE,qBAAqB,UAAU,KAAK,SAAY,OAAO,KAAK,EAAE,CAAC;AAAA;AAAA,MAC1F;AAAA,OACF;AAAA,IACA,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,iCAAmB;AAAA,MAC1D;AAAA,QAAC;AAAA;AAAA,UACC,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK;AAAA,UACvC,QAAQ,MAAM,SAAS,EAAE,kBAAkB,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,CAAC;AAAA;AAAA,MACnG;AAAA,MACA,oBAAC,SAAI,WAAU,iCAAgC,uCAAyB;AAAA,OAC1E;AAAA,IACA,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,4BAAc;AAAA,MACrD;AAAA,QAAC;AAAA;AAAA,UACC,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,aAAa,EAAE,OAAO,KAAK;AAAA,UAC5C,QAAQ,MAAM,SAAS,EAAE,eAAe,UAAU,KAAK,KAAK,OAAU,CAAC;AAAA;AAAA,MACzE;AAAA,MACA,oBAAC,SAAI,WAAU,iCAAgC,8FAE/C;AAAA,OACF;AAAA,KACF;AAEJ;AAEA,cAAc,SAAS,cAAc;AAAA,EACnC,OAAO,CAAC,UAAU,oBAAC,mBAAgB,UAAU,MAAM,UAAU,UAAU,MAAM,UAAU,KAAK,MAAM,KAAK,UAAU,MAAM,UAAU;AAAA,EACjI,WAAW,CAAC,MAAM,oBAAC,uBAAqB,GAAG,GAAG;AAChD,CAAC;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { FieldRegistry } from '@open-mercato/ui/backend/fields/registry'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type { CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Upload } from 'lucide-react'\n\nfunction humanSize(n: number): string {\n  if (!Number.isFinite(n)) return String(n)\n  const units = ['B','KB','MB','GB']\n  let i = 0\n  let x = n\n  while (x >= 1024 && i < units.length - 1) { x /= 1024; i++ }\n  return `${x.toFixed(i === 0 ? 0 : 1)} ${units[i]}`\n}\n\ntype AttachmentsResponse = {\n  items?: Array<{ id: string; url: string; fileName: string; fileSize: number }>\n  error?: string\n}\n\ntype AttachmentFieldDef = CustomFieldDefDto & {\n  configJson?: {\n    maxAttachmentSizeMb?: number\n    acceptExtensions?: string[]\n    partitionCode?: string\n  }\n}\n\ntype AttachmentDefEditorPatch = {\n  maxAttachmentSizeMb?: number\n  acceptExtensions?: string[]\n  partitionCode?: string\n}\n\nfunction buildAcceptAttribute(def?: AttachmentFieldDef): string | undefined {\n  if (!Array.isArray(def?.acceptExtensions) || def.acceptExtensions.length === 0) return undefined\n  const values = def.acceptExtensions\n    .map((entry) => String(entry ?? '').trim().replace(/^\\./, ''))\n    .filter((entry) => entry.length > 0)\n  if (values.length === 0) return undefined\n  return values.map((entry) => `.${entry}`).join(',')\n}\n\nexport const AttachmentInput = ({\n  entityId,\n  recordId,\n  def,\n  disabled,\n}: {\n  entityId?: string\n  recordId?: string\n  def?: AttachmentFieldDef\n  disabled?: boolean\n}) => {\n  const t = useT()\n  const [items, setItems] = React.useState<Array<{ id: string; url: string; fileName: string; fileSize: number }>>([])\n  const [loading, setLoading] = React.useState(false)\n  const [error, setError] = React.useState<string | null>(null)\n  const [uploading, setUploading] = React.useState(false)\n  const fileInputRef = React.useRef<HTMLInputElement | null>(null)\n  const accept = React.useMemo(() => buildAcceptAttribute(def), [def])\n\n  const load = React.useCallback(async () => {\n    if (!entityId || !recordId) return\n    try {\n      setLoading(true)\n      const call = await apiCall<AttachmentsResponse>(\n        `/api/attachments?entityId=${encodeURIComponent(entityId)}&recordId=${encodeURIComponent(recordId)}`,\n        undefined,\n        { fallback: { items: [] } },\n      )\n      if (!call.ok) {\n        const message = call.result?.error || t('attachments.library.errors.load', 'Failed to load attachments.')\n        throw new Error(message)\n      }\n      const j = call.result ?? { items: [] }\n      setItems(Array.isArray(j.items) ? j.items : [])\n    } catch (error: unknown) {\n      setError(error instanceof Error ? error.message : t('attachments.library.errors.load', 'Failed to load attachments.'))\n    } finally {\n      setLoading(false)\n    }\n  }, [entityId, recordId, t])\n\n  React.useEffect(() => { load() }, [load])\n\n  const onUpload = async (files: FileList | null) => {\n    if (!files || !entityId || !recordId) return\n    setError(null)\n    setUploading(true)\n    try {\n      for (const file of Array.from(files)) {\n        const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n        const acceptExtensions = Array.isArray(def?.acceptExtensions) ? def.acceptExtensions : []\n        if (acceptExtensions.length > 0) {\n          const allowed = new Set(acceptExtensions.map((entry) => String(entry).toLowerCase().replace(/^\\./, '')))\n          if (!allowed.has(ext)) { setError('File type not allowed'); continue }\n        }\n        const maxAttachmentSizeMb = typeof def?.maxAttachmentSizeMb === 'number' ? def.maxAttachmentSizeMb : undefined\n        if (typeof maxAttachmentSizeMb === 'number' && maxAttachmentSizeMb > 0) {\n          const maxBytes = Math.floor(maxAttachmentSizeMb * 1024 * 1024)\n          if (file.size > maxBytes) { setError(`File exceeds ${maxAttachmentSizeMb} MB limit`); continue }\n        }\n        const fd = new FormData()\n        fd.set('entityId', entityId)\n        fd.set('recordId', recordId)\n        if (def?.key) fd.set('fieldKey', String(def.key))\n        fd.set('file', file)\n        const call = await apiCall<{ error?: string }>(\n          '/api/attachments',\n          { method: 'POST', body: fd },\n          { fallback: null },\n        )\n        if (!call.ok) {\n          setError(call.result?.error || t('attachments.library.upload.failed', 'Upload failed.'))\n          break\n        }\n      }\n      await load()\n    } finally {\n      setUploading(false)\n      if (fileInputRef.current) {\n        fileInputRef.current.value = ''\n      }\n    }\n  }\n\n  return (\n    <div className=\"space-y-3\">\n      {!entityId || !recordId ? (\n        <div className=\"rounded-md border border-dashed border-border/70 px-3 py-4 text-sm text-muted-foreground\">\n          {t('attachments.library.upload.saveFirst', 'Save the record before uploading files.')}\n        </div>\n      ) : (\n        <div className=\"rounded-md border border-dashed border-border/70 bg-muted/30 px-4 py-4\">\n          <div className=\"flex flex-wrap items-center gap-3\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => fileInputRef.current?.click()}\n              disabled={disabled || uploading}\n            >\n              <Upload className=\"h-4 w-4\" />\n              {uploading\n                ? t('attachments.library.upload.submitting', 'Uploading\u2026')\n                : t('attachments.library.upload.choose', 'Choose files')}\n            </Button>\n          </div>\n          <input\n            ref={fileInputRef}\n            type=\"file\"\n            multiple\n            className=\"hidden\"\n            accept={accept}\n            disabled={disabled || uploading}\n            onChange={(event) => { void onUpload(event.target.files) }}\n          />\n        </div>\n      )}\n      {error ? <div className=\"text-xs text-red-600\">{error}</div> : null}\n      <div className=\"space-y-1\">\n        {loading ? <div className=\"text-xs text-muted-foreground\">{t('attachments.library.loading', 'Loading attachments\u2026')}</div> : null}\n        {items.map(it => (\n          <div key={it.id} className=\"text-sm\">\n            <a className=\"underline\" href={it.url} target=\"_blank\" rel=\"noreferrer\">{it.fileName}</a>\n            <span className=\"text-xs text-muted-foreground\"> \u2022 {humanSize(it.fileSize)}</span>\n          </div>\n        ))}\n        {!loading && items.length === 0 ? <div className=\"text-xs text-muted-foreground\">{t('attachments.library.table.empty', 'No attachments found.')}</div> : null}\n      </div>\n    </div>\n  )\n}\n\n// Register with field registry under kind 'attachment'\nfunction AttachmentDefEditor({ def, onChange }: { def: AttachmentFieldDef; onChange: (patch: AttachmentDefEditorPatch) => void }) {\n  const cfg = def?.configJson || {}\n  const [maxMb, setMaxMb] = React.useState<number | ''>(typeof cfg.maxAttachmentSizeMb === 'number' ? cfg.maxAttachmentSizeMb : '')\n  const [exts, setExts] = React.useState<string>((Array.isArray(cfg.acceptExtensions) ? cfg.acceptExtensions : []).join(', '))\n  const [partition, setPartition] = React.useState<string>(typeof cfg.partitionCode === 'string' ? cfg.partitionCode : '')\n  return (\n    <div className=\"grid grid-cols-1 gap-3 md:grid-cols-2\">\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Max file size (MB)</label>\n        <Input\n          type=\"number\"\n          min={0}\n          placeholder=\"e.g., 10\"\n          value={maxMb}\n          onChange={(e) => setMaxMb(e.target.value === '' ? '' : Number(e.target.value))}\n          onBlur={() => onChange({ maxAttachmentSizeMb: maxMb === '' ? undefined : Number(maxMb) })}\n        />\n      </div>\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Accepted extensions</label>\n        <Input\n          placeholder=\"e.g., pdf, jpg, png\"\n          value={exts}\n          onChange={(e) => setExts(e.target.value)}\n          onBlur={() => onChange({ acceptExtensions: exts.split(',').map((s) => s.trim()).filter(Boolean) })}\n        />\n        <div className=\"text-xs text-muted-foreground\">Leave blank to allow any.</div>\n      </div>\n      <div className=\"space-y-2\">\n        <label className=\"text-xs font-medium\">Partition code</label>\n        <Input\n          placeholder=\"e.g., productsMedia\"\n          value={partition}\n          onChange={(e) => setPartition(e.target.value)}\n          onBlur={() => onChange({ partitionCode: partition.trim() || undefined })}\n        />\n        <div className=\"text-xs text-muted-foreground\">\n          Configure partitions under Settings \u2192 Attachments. Leave blank for default.\n        </div>\n      </div>\n    </div>\n  )\n}\n\nFieldRegistry.register('attachment', {\n  input: (props) => <AttachmentInput entityId={props.entityId} recordId={props.recordId} def={props.def} disabled={props.disabled} />,\n  defEditor: (p) => <AttachmentDefEditor {...p} />,\n})\n\nexport {}\n"],
+  "mappings": ";AAsIQ,cAMI,YANJ;AArIR,YAAY,WAAW;AACvB,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAExB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,cAAc;AAEvB,SAAS,UAAU,GAAmB;AACpC,MAAI,CAAC,OAAO,SAAS,CAAC,EAAG,QAAO,OAAO,CAAC;AACxC,QAAM,QAAQ,CAAC,KAAI,MAAK,MAAK,IAAI;AACjC,MAAI,IAAI;AACR,MAAI,IAAI;AACR,SAAO,KAAK,QAAQ,IAAI,MAAM,SAAS,GAAG;AAAE,SAAK;AAAM;AAAA,EAAI;AAC3D,SAAO,GAAG,EAAE,QAAQ,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;AAClD;AAqBA,SAAS,qBAAqB,KAA8C;AAC1E,MAAI,CAAC,MAAM,QAAQ,KAAK,gBAAgB,KAAK,IAAI,iBAAiB,WAAW,EAAG,QAAO;AACvF,QAAM,SAAS,IAAI,iBAChB,IAAI,CAAC,UAAU,OAAO,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,OAAO,EAAE,CAAC,EAC5D,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,OAAO,IAAI,CAAC,UAAU,IAAI,KAAK,EAAE,EAAE,KAAK,GAAG;AACpD;AAEO,MAAM,kBAAkB,CAAC;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAKM;AACJ,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAiF,CAAC,CAAC;AACnH,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,eAAe,MAAM,OAAgC,IAAI;AAC/D,QAAM,SAAS,MAAM,QAAQ,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,CAAC;AAEnE,QAAM,OAAO,MAAM,YAAY,YAAY;AACzC,QAAI,CAAC,YAAY,CAAC,SAAU;AAC5B,QAAI;AACF,iBAAW,IAAI;AACf,YAAM,OAAO,MAAM;AAAA,QACjB,6BAA6B,mBAAmB,QAAQ,CAAC,aAAa,mBAAmB,QAAQ,CAAC;AAAA,QAClG;AAAA,QACA,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,MAC5B;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,UAAU,KAAK,QAAQ,SAAS,EAAE,mCAAmC,6BAA6B;AACxG,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB;AACA,YAAM,IAAI,KAAK,UAAU,EAAE,OAAO,CAAC,EAAE;AACrC,eAAS,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,QAAQ,CAAC,CAAC;AAAA,IAChD,SAASA,QAAgB;AACvB,eAASA,kBAAiB,QAAQA,OAAM,UAAU,EAAE,mCAAmC,6BAA6B,CAAC;AAAA,IACvH,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,UAAU,UAAU,CAAC,CAAC;AAE1B,QAAM,UAAU,MAAM;AAAE,SAAK;AAAA,EAAE,GAAG,CAAC,IAAI,CAAC;AAExC,QAAM,WAAW,OAAO,UAA2B;AACjD,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAU;AACtC,aAAS,IAAI;AACb,iBAAa,IAAI;AACjB,QAAI;AACF,iBAAW,QAAQ,MAAM,KAAK,KAAK,GAAG;AACpC,cAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,cAAM,mBAAmB,MAAM,QAAQ,KAAK,gBAAgB,IAAI,IAAI,mBAAmB,CAAC;AACxF,YAAI,iBAAiB,SAAS,GAAG;AAC/B,gBAAM,UAAU,IAAI,IAAI,iBAAiB,IAAI,CAAC,UAAU,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACvG,cAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AAAE,qBAAS,uBAAuB;AAAG;AAAA,UAAS;AAAA,QACvE;AACA,cAAM,sBAAsB,OAAO,KAAK,wBAAwB,WAAW,IAAI,sBAAsB;AACrG,YAAI,OAAO,wBAAwB,YAAY,sBAAsB,GAAG;AACtE,gBAAM,WAAW,KAAK,MAAM,sBAAsB,OAAO,IAAI;AAC7D,cAAI,KAAK,OAAO,UAAU;AAAE,qBAAS,gBAAgB,mBAAmB,WAAW;AAAG;AAAA,UAAS;AAAA,QACjG;AACA,cAAM,KAAK,IAAI,SAAS;AACxB,WAAG,IAAI,YAAY,QAAQ;AAC3B,WAAG,IAAI,YAAY,QAAQ;AAC3B,YAAI,KAAK,IAAK,IAAG,IAAI,YAAY,OAAO,IAAI,GAAG,CAAC;AAChD,WAAG,IAAI,QAAQ,IAAI;AACnB,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA,EAAE,QAAQ,QAAQ,MAAM,GAAG;AAAA,UAC3B,EAAE,UAAU,KAAK;AAAA,QACnB;AACA,YAAI,CAAC,KAAK,IAAI;AACZ,mBAAS,KAAK,QAAQ,SAAS,EAAE,qCAAqC,gBAAgB,CAAC;AACvF;AAAA,QACF;AAAA,MACF;AACA,YAAM,KAAK;AAAA,IACb,UAAE;AACA,mBAAa,KAAK;AAClB,UAAI,aAAa,SAAS;AACxB,qBAAa,QAAQ,QAAQ;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,KAAC,YAAY,CAAC,WACb,oBAAC,SAAI,WAAU,4FACZ,YAAE,wCAAwC,yCAAyC,GACtF,IAEA,qBAAC,SAAI,WAAU,0EACb;AAAA,0BAAC,SAAI,WAAU,qCACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,aAAa,SAAS,MAAM;AAAA,UAC3C,UAAU,YAAY;AAAA,UAEtB;AAAA,gCAAC,UAAO,WAAU,WAAU;AAAA,YAC3B,YACG,EAAE,yCAAyC,iBAAY,IACvD,EAAE,qCAAqC,cAAc;AAAA;AAAA;AAAA,MAC3D,GACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK;AAAA,UACL,MAAK;AAAA,UACL,UAAQ;AAAA,UACR,WAAU;AAAA,UACV;AAAA,UACA,UAAU,YAAY;AAAA,UACtB,UAAU,CAAC,UAAU;AAAE,iBAAK,SAAS,MAAM,OAAO,KAAK;AAAA,UAAE;AAAA;AAAA,MAC3D;AAAA,OACF;AAAA,IAED,QAAQ,oBAAC,SAAI,WAAU,wBAAwB,iBAAM,IAAS;AAAA,IAC/D,qBAAC,SAAI,WAAU,aACZ;AAAA,gBAAU,oBAAC,SAAI,WAAU,iCAAiC,YAAE,+BAA+B,2BAAsB,GAAE,IAAS;AAAA,MAC5H,MAAM,IAAI,QACT,qBAAC,SAAgB,WAAU,WACzB;AAAA,4BAAC,OAAE,WAAU,aAAY,MAAM,GAAG,KAAK,QAAO,UAAS,KAAI,cAAc,aAAG,UAAS;AAAA,QACrF,qBAAC,UAAK,WAAU,iCAAgC;AAAA;AAAA,UAAI,UAAU,GAAG,QAAQ;AAAA,WAAE;AAAA,WAFnE,GAAG,EAGb,CACD;AAAA,MACA,CAAC,WAAW,MAAM,WAAW,IAAI,oBAAC,SAAI,WAAU,iCAAiC,YAAE,mCAAmC,uBAAuB,GAAE,IAAS;AAAA,OAC3J;AAAA,KACF;AAEJ;AAGA,SAAS,oBAAoB,EAAE,KAAK,SAAS,GAAqF;AAChI,QAAM,MAAM,KAAK,cAAc,CAAC;AAChC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAsB,OAAO,IAAI,wBAAwB,WAAW,IAAI,sBAAsB,EAAE;AAChI,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,UAAkB,MAAM,QAAQ,IAAI,gBAAgB,IAAI,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC;AAC3H,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAiB,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB,EAAE;AACvH,SACE,qBAAC,SAAI,WAAU,yCACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,gCAAkB;AAAA,MACzD;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,KAAK;AAAA,UACL,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,UAAU,KAAK,KAAK,OAAO,EAAE,OAAO,KAAK,CAAC;AAAA,UAC7E,QAAQ,MAAM,SAAS,EAAE,qBAAqB,UAAU,KAAK,SAAY,OAAO,KAAK,EAAE,CAAC;AAAA;AAAA,MAC1F;AAAA,OACF;AAAA,IACA,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,iCAAmB;AAAA,MAC1D;AAAA,QAAC;AAAA;AAAA,UACC,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK;AAAA,UACvC,QAAQ,MAAM,SAAS,EAAE,kBAAkB,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,CAAC;AAAA;AAAA,MACnG;AAAA,MACA,oBAAC,SAAI,WAAU,iCAAgC,uCAAyB;AAAA,OAC1E;AAAA,IACA,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,WAAM,WAAU,uBAAsB,4BAAc;AAAA,MACrD;AAAA,QAAC;AAAA;AAAA,UACC,aAAY;AAAA,UACZ,OAAO;AAAA,UACP,UAAU,CAAC,MAAM,aAAa,EAAE,OAAO,KAAK;AAAA,UAC5C,QAAQ,MAAM,SAAS,EAAE,eAAe,UAAU,KAAK,KAAK,OAAU,CAAC;AAAA;AAAA,MACzE;AAAA,MACA,oBAAC,SAAI,WAAU,iCAAgC,8FAE/C;AAAA,OACF;AAAA,KACF;AAEJ;AAEA,cAAc,SAAS,cAAc;AAAA,EACnC,OAAO,CAAC,UAAU,oBAAC,mBAAgB,UAAU,MAAM,UAAU,UAAU,MAAM,UAAU,KAAK,MAAM,KAAK,UAAU,MAAM,UAAU;AAAA,EACjI,WAAW,CAAC,MAAM,oBAAC,uBAAqB,GAAG,GAAG;AAChD,CAAC;",
   "names": ["error"]
 }

package/dist/modules/attachments/lib/drivers/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/lib/drivers/index.ts"],
-  "sourcesContent": ["export type { PrepareFilePayload, StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\nexport { LocalStorageDriver } from './localDriver'\nexport { LegacyPublicStorageDriver } from './legacyPublicDriver'\nexport { StorageDriverFactory, registerExternalStorageDriver, registerExternalCredentialEnhancer } from './driverFactory'\n"],
+  "sourcesContent": ["export type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\nexport { LocalStorageDriver } from './localDriver'\nexport { LegacyPublicStorageDriver } from './legacyPublicDriver'\nexport { StorageDriverFactory, registerExternalStorageDriver, registerExternalCredentialEnhancer } from './driverFactory'\n"],
   "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,iCAAiC;AAC1C,SAAS,sBAAsB,+BAA+B,0CAA0C;",
   "names": []
 }

package/dist/modules/attachments/lib/drivers/localDriver.js

@@ -19,20 +19,17 @@ class LocalStorageDriver {
   constructor() {
     this.key = "local";
   }
-  prepareStoragePath(payload) {
+  async store(payload) {
+    const root = resolvePartitionRoot(payload.partitionCode);
     const orgSegment = resolveOrgSegment(payload.orgId ?? null);
     const tenantSegment = resolveTenantSegment(payload.tenantId ?? null);
     const safeName = sanitizeFileName(payload.fileName || "file");
     const uniqueSuffix = randomUUID().replace(/-/g, "").slice(0, 12);
     const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`;
-    return path.join(orgSegment, tenantSegment, storedName).replace(/\\/g, "/");
-  }
-  async store(payload) {
-    const root = resolvePartitionRoot(payload.partitionCode);
-    const relativePath = payload.storagePath ?? this.prepareStoragePath(payload);
+    const relativePath = path.join(orgSegment, tenantSegment, storedName);
     const absolutePath = path.join(root, relativePath);
     await fs.mkdir(path.dirname(absolutePath), { recursive: true });
-    await fs.writeFile(absolutePath, payload.buffer, { flag: "wx" });
+    await fs.writeFile(absolutePath, payload.buffer);
     return {
       storagePath: relativePath.replace(/\\/g, "/")
     };
@@ -43,20 +40,10 @@ class LocalStorageDriver {
     return { buffer };
   }
   async delete(partitionCode, storagePath) {
-    try {
-      await this.deleteStrict(partitionCode, storagePath);
-    } catch {
-    }
-  }
-  async deleteStrict(partitionCode, storagePath) {
     const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath);
     try {
-      if (typeof fs.rm === "function") await fs.rm(absolutePath, { force: true });
-      else await fs.unlink(absolutePath);
-    } catch (error) {
-      const code = error?.code;
-      const message = error instanceof Error ? error.message : "";
-      if (code !== "ENOENT" && !message.includes("ENOENT")) throw error;
+      await fs.unlink(absolutePath);
+    } catch {
     }
   }
   async toLocalPath(partitionCode, storagePath) {

package/dist/modules/attachments/lib/drivers/localDriver.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/lib/drivers/localDriver.ts"],
-  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { randomUUID } from 'crypto'\nimport { resolvePartitionRoot } from '../storage'\nimport { resolveContainedPath } from '../pathContainment'\nimport type { PrepareFilePayload, StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\n\nfunction sanitizeFileName(fileName: string): string {\n  if (!fileName) return 'file'\n  return fileName.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction resolveOrgSegment(orgId: string | null | undefined): string {\n  if (typeof orgId === 'string' && orgId.trim().length > 0) return `org_${orgId}`\n  return 'org_shared'\n}\n\nfunction resolveTenantSegment(tenantId: string | null | undefined): string {\n  if (typeof tenantId === 'string' && tenantId.trim().length > 0) return `tenant_${tenantId}`\n  return 'tenant_shared'\n}\n\nexport class LocalStorageDriver implements StorageDriver {\n  readonly key = 'local'\n\n  prepareStoragePath(payload: PrepareFilePayload): string {\n    const orgSegment = resolveOrgSegment(payload.orgId ?? null)\n    const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)\n    const safeName = sanitizeFileName(payload.fileName || 'file')\n    const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n    const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`\n    return path.join(orgSegment, tenantSegment, storedName).replace(/\\\\/g, '/')\n  }\n\n  async store(payload: StoreFilePayload): Promise<StoredFile> {\n    const root = resolvePartitionRoot(payload.partitionCode)\n    const relativePath = payload.storagePath ?? this.prepareStoragePath(payload)\n    const absolutePath = path.join(root, relativePath)\n    await fs.mkdir(path.dirname(absolutePath), { recursive: true })\n    await fs.writeFile(absolutePath, payload.buffer, { flag: 'wx' })\n    return {\n      storagePath: relativePath.replace(/\\\\/g, '/'),\n    }\n  }\n\n  async read(partitionCode: string, storagePath: string): Promise<ReadFileResult> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    const buffer = await fs.readFile(absolutePath)\n    return { buffer }\n  }\n\n  async delete(partitionCode: string, storagePath: string): Promise<void> {\n    try {\n      await this.deleteStrict(partitionCode, storagePath)\n    } catch {\n      // Backward-compatible best-effort removal.\n    }\n  }\n\n  async deleteStrict(partitionCode: string, storagePath: string): Promise<void> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    try {\n      if (typeof fs.rm === 'function') await fs.rm(absolutePath, { force: true })\n      else await fs.unlink(absolutePath)\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException)?.code\n      const message = error instanceof Error ? error.message : ''\n      if (code !== 'ENOENT' && !message.includes('ENOENT')) throw error\n    }\n  }\n\n  async toLocalPath(\n    partitionCode: string,\n    storagePath: string,\n  ): Promise<{ filePath: string; cleanup: () => Promise<void> }> {\n    const filePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    return {\n      filePath,\n      cleanup: async () => {\n        // no-op: local path is the real file, do not delete\n      },\n    }\n  }\n\n  private resolveAbsolutePath(partitionCode: string, storagePath: string): string {\n    const root = resolvePartitionRoot(partitionCode)\n    return resolveContainedPath(root, storagePath)\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AAGrC,SAAS,iBAAiB,UAA0B;AAClD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,QAAQ,oBAAoB,GAAG;AACjD;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC7E,SAAO;AACT;AAEA,SAAS,qBAAqB,UAA6C;AACzE,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO,UAAU,QAAQ;AACzF,SAAO;AACT;AAEO,MAAM,mBAA4C;AAAA,EAAlD;AACL,SAAS,MAAM;AAAA;AAAA,EAEf,mBAAmB,SAAqC;AACtD,UAAM,aAAa,kBAAkB,QAAQ,SAAS,IAAI;AAC1D,UAAM,gBAAgB,qBAAqB,QAAQ,YAAY,IAAI;AACnE,UAAM,WAAW,iBAAiB,QAAQ,YAAY,MAAM;AAC5D,UAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,UAAM,aAAa,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AAC5D,WAAO,KAAK,KAAK,YAAY,eAAe,UAAU,EAAE,QAAQ,OAAO,GAAG;AAAA,EAC5E;AAAA,EAEA,MAAM,MAAM,SAAgD;AAC1D,UAAM,OAAO,qBAAqB,QAAQ,aAAa;AACvD,UAAM,eAAe,QAAQ,eAAe,KAAK,mBAAmB,OAAO;AAC3E,UAAM,eAAe,KAAK,KAAK,MAAM,YAAY;AACjD,UAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,UAAM,GAAG,UAAU,cAAc,QAAQ,QAAQ,EAAE,MAAM,KAAK,CAAC;AAC/D,WAAO;AAAA,MACL,aAAa,aAAa,QAAQ,OAAO,GAAG;AAAA,IAC9C;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,eAAuB,aAA8C;AAC9E,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,UAAM,SAAS,MAAM,GAAG,SAAS,YAAY;AAC7C,WAAO,EAAE,OAAO;AAAA,EAClB;AAAA,EAEA,MAAM,OAAO,eAAuB,aAAoC;AACtE,QAAI;AACF,YAAM,KAAK,aAAa,eAAe,WAAW;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,eAAuB,aAAoC;AAC5E,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,QAAI;AACF,UAAI,OAAO,GAAG,OAAO,WAAY,OAAM,GAAG,GAAG,cAAc,EAAE,OAAO,KAAK,CAAC;AAAA,UACrE,OAAM,GAAG,OAAO,YAAY;AAAA,IACnC,SAAS,OAAO;AACd,YAAM,OAAQ,OAAiC;AAC/C,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,UAAI,SAAS,YAAY,CAAC,QAAQ,SAAS,QAAQ,EAAG,OAAM;AAAA,IAC9D;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,eACA,aAC6D;AAC7D,UAAM,WAAW,KAAK,oBAAoB,eAAe,WAAW;AACpE,WAAO;AAAA,MACL;AAAA,MACA,SAAS,YAAY;AAAA,MAErB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,oBAAoB,eAAuB,aAA6B;AAC9E,UAAM,OAAO,qBAAqB,aAAa;AAC/C,WAAO,qBAAqB,MAAM,WAAW;AAAA,EAC/C;AACF;",
+  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { randomUUID } from 'crypto'\nimport { resolvePartitionRoot } from '../storage'\nimport { resolveContainedPath } from '../pathContainment'\nimport type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\n\nfunction sanitizeFileName(fileName: string): string {\n  if (!fileName) return 'file'\n  return fileName.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction resolveOrgSegment(orgId: string | null | undefined): string {\n  if (typeof orgId === 'string' && orgId.trim().length > 0) return `org_${orgId}`\n  return 'org_shared'\n}\n\nfunction resolveTenantSegment(tenantId: string | null | undefined): string {\n  if (typeof tenantId === 'string' && tenantId.trim().length > 0) return `tenant_${tenantId}`\n  return 'tenant_shared'\n}\n\nexport class LocalStorageDriver implements StorageDriver {\n  readonly key = 'local'\n\n  async store(payload: StoreFilePayload): Promise<StoredFile> {\n    const root = resolvePartitionRoot(payload.partitionCode)\n    const orgSegment = resolveOrgSegment(payload.orgId ?? null)\n    const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)\n    const safeName = sanitizeFileName(payload.fileName || 'file')\n    const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n    const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`\n    const relativePath = path.join(orgSegment, tenantSegment, storedName)\n    const absolutePath = path.join(root, relativePath)\n    await fs.mkdir(path.dirname(absolutePath), { recursive: true })\n    await fs.writeFile(absolutePath, payload.buffer)\n    return {\n      storagePath: relativePath.replace(/\\\\/g, '/'),\n    }\n  }\n\n  async read(partitionCode: string, storagePath: string): Promise<ReadFileResult> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    const buffer = await fs.readFile(absolutePath)\n    return { buffer }\n  }\n\n  async delete(partitionCode: string, storagePath: string): Promise<void> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    try {\n      await fs.unlink(absolutePath)\n    } catch {\n      // best-effort removal\n    }\n  }\n\n  async toLocalPath(\n    partitionCode: string,\n    storagePath: string,\n  ): Promise<{ filePath: string; cleanup: () => Promise<void> }> {\n    const filePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    return {\n      filePath,\n      cleanup: async () => {\n        // no-op: local path is the real file, do not delete\n      },\n    }\n  }\n\n  private resolveAbsolutePath(partitionCode: string, storagePath: string): string {\n    const root = resolvePartitionRoot(partitionCode)\n    return resolveContainedPath(root, storagePath)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AAGrC,SAAS,iBAAiB,UAA0B;AAClD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,QAAQ,oBAAoB,GAAG;AACjD;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC7E,SAAO;AACT;AAEA,SAAS,qBAAqB,UAA6C;AACzE,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO,UAAU,QAAQ;AACzF,SAAO;AACT;AAEO,MAAM,mBAA4C;AAAA,EAAlD;AACL,SAAS,MAAM;AAAA;AAAA,EAEf,MAAM,MAAM,SAAgD;AAC1D,UAAM,OAAO,qBAAqB,QAAQ,aAAa;AACvD,UAAM,aAAa,kBAAkB,QAAQ,SAAS,IAAI;AAC1D,UAAM,gBAAgB,qBAAqB,QAAQ,YAAY,IAAI;AACnE,UAAM,WAAW,iBAAiB,QAAQ,YAAY,MAAM;AAC5D,UAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,UAAM,aAAa,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AAC5D,UAAM,eAAe,KAAK,KAAK,YAAY,eAAe,UAAU;AACpE,UAAM,eAAe,KAAK,KAAK,MAAM,YAAY;AACjD,UAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,UAAM,GAAG,UAAU,cAAc,QAAQ,MAAM;AAC/C,WAAO;AAAA,MACL,aAAa,aAAa,QAAQ,OAAO,GAAG;AAAA,IAC9C;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,eAAuB,aAA8C;AAC9E,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,UAAM,SAAS,MAAM,GAAG,SAAS,YAAY;AAC7C,WAAO,EAAE,OAAO;AAAA,EAClB;AAAA,EAEA,MAAM,OAAO,eAAuB,aAAoC;AACtE,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,QAAI;AACF,YAAM,GAAG,OAAO,YAAY;AAAA,IAC9B,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,eACA,aAC6D;AAC7D,UAAM,WAAW,KAAK,oBAAoB,eAAe,WAAW;AACpE,WAAO;AAAA,MACL;AAAA,MACA,SAAS,YAAY;AAAA,MAErB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,oBAAoB,eAAuB,aAA6B;AAC9E,UAAM,OAAO,qBAAqB,aAAa;AAC/C,WAAO,qBAAqB,MAAM,WAAW;AAAA,EAC/C;AACF;",
   "names": []
 }

package/dist/modules/attachments/lib/upload-limits.js

@@ -39,44 +39,11 @@ function isMultipartRequestWithinUploadLimit(contentLengthHeader) {
   if (!Number.isFinite(contentLength) || contentLength <= 0) return true;
   return contentLength <= resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES;
 }
-class MultipartUploadLimitError extends Error {
-  constructor() {
-    super("Multipart request exceeds the maximum upload size.");
-    this.name = "MultipartUploadLimitError";
-  }
-}
-function isMultipartUploadLimitError(error) {
-  return error instanceof MultipartUploadLimitError;
-}
-async function parseMultipartFormDataWithinUploadLimit(request) {
-  if (!isMultipartRequestWithinUploadLimit(request.headers.get("content-length"))) {
-    throw new MultipartUploadLimitError();
-  }
-  if (!request.body) return request.formData();
-  const maxBytes = resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES;
-  let consumedBytes = 0;
-  const boundedBody = request.body.pipeThrough(new TransformStream({
-    transform(chunk, controller) {
-      consumedBytes += chunk.byteLength;
-      if (consumedBytes > maxBytes) {
-        controller.error(new MultipartUploadLimitError());
-        return;
-      }
-      controller.enqueue(chunk);
-    }
-  }));
-  const contentType = request.headers.get("content-type");
-  const headers = contentType ? { "content-type": contentType } : void 0;
-  return new Response(boundedBody, { headers }).formData();
-}
 function willExceedAttachmentTenantQuota(currentUsageBytes, incomingFileBytes) {
   return currentUsageBytes + incomingFileBytes > resolveAttachmentTenantQuotaBytes();
 }
 export {
-  MultipartUploadLimitError,
   isMultipartRequestWithinUploadLimit,
-  isMultipartUploadLimitError,
-  parseMultipartFormDataWithinUploadLimit,
   resolveAttachmentMaxBytes,
   resolveAttachmentTenantQuotaBytes,
   resolveDefaultAttachmentMaxUploadBytes,

package/dist/modules/attachments/lib/upload-limits.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/upload-limits.ts"],
-  "sourcesContent": ["const DEFAULT_ATTACHMENT_MAX_UPLOAD_MB = 25\nconst DEFAULT_ATTACHMENT_TENANT_QUOTA_MB = 512\nconst MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES = 1024 * 1024\nconst ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_MAX_UPLOAD_MB',\n  'OPENMERCATO_ATTACHMENT_MAX_UPLOAD_MB',\n] as const\nconst ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_TENANT_QUOTA_MB',\n  'OPENMERCATO_ATTACHMENT_TENANT_QUOTA_MB',\n] as const\n\nfunction readEnvValue(names: readonly string[]): string | undefined {\n  return names.map((name) => process.env[name]).find((value) => typeof value === 'string')\n}\n\nfunction parseMegabytesEnv(names: readonly string[], fallbackMb: number): number {\n  const raw = readEnvValue(names)\n  const parsed = raw ? Number(raw) : NaN\n  if (Number.isFinite(parsed) && parsed > 0) {\n    return parsed\n  }\n  return fallbackMb\n}\n\nexport function resolveDefaultAttachmentMaxUploadBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS, DEFAULT_ATTACHMENT_MAX_UPLOAD_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentTenantQuotaBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS, DEFAULT_ATTACHMENT_TENANT_QUOTA_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | null): number {\n  const defaultMaxBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (typeof fieldMaxAttachmentSizeMb !== 'number' || fieldMaxAttachmentSizeMb <= 0) {\n    return defaultMaxBytes\n  }\n  return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))\n}\n\nexport function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {\n  if (!contentLengthHeader) return true\n  const contentLength = Number(contentLengthHeader)\n  if (!Number.isFinite(contentLength) || contentLength <= 0) return true\n  return contentLength <= (resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES)\n}\n\nexport class MultipartUploadLimitError extends Error {\n  constructor() {\n    super('Multipart request exceeds the maximum upload size.')\n    this.name = 'MultipartUploadLimitError'\n  }\n}\n\nexport function isMultipartUploadLimitError(error: unknown): error is MultipartUploadLimitError {\n  return error instanceof MultipartUploadLimitError\n}\n\nexport async function parseMultipartFormDataWithinUploadLimit(request: Request): Promise<FormData> {\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    throw new MultipartUploadLimitError()\n  }\n\n  if (!request.body) return request.formData()\n\n  const maxBytes = resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES\n  let consumedBytes = 0\n  const boundedBody = request.body.pipeThrough(new TransformStream<Uint8Array, Uint8Array>({\n    transform(chunk, controller) {\n      consumedBytes += chunk.byteLength\n      if (consumedBytes > maxBytes) {\n        controller.error(new MultipartUploadLimitError())\n        return\n      }\n      controller.enqueue(chunk)\n    },\n  }))\n  const contentType = request.headers.get('content-type')\n  const headers = contentType ? { 'content-type': contentType } : undefined\n  return new Response(boundedBody, { headers }).formData()\n}\n\nexport function willExceedAttachmentTenantQuota(currentUsageBytes: number, incomingFileBytes: number): boolean {\n  return (currentUsageBytes + incomingFileBytes) > resolveAttachmentTenantQuotaBytes()\n}\n"],
-  "mappings": "AAAA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,0CAA0C,OAAO;AACvD,MAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AACF;AACA,MAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AACF;AAEA,SAAS,aAAa,OAA8C;AAClE,SAAO,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ;AACzF;AAEA,SAAS,kBAAkB,OAA0B,YAA4B;AAC/E,QAAM,MAAM,aAAa,KAAK;AAC9B,QAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACnC,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,yCAAiD;AAC/D,SAAO,KAAK,MAAM,kBAAkB,mCAAmC,gCAAgC,IAAI,OAAO,IAAI;AACxH;AAEO,SAAS,oCAA4C;AAC1D,SAAO,KAAK,MAAM,kBAAkB,qCAAqC,kCAAkC,IAAI,OAAO,IAAI;AAC5H;AAEO,SAAS,0BAA0B,0BAAkD;AAC1F,QAAM,kBAAkB,uCAAuC;AAC/D,MAAI,OAAO,6BAA6B,YAAY,4BAA4B,GAAG;AACjF,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,iBAAiB,KAAK,MAAM,2BAA2B,OAAO,IAAI,CAAC;AACrF;AAEO,SAAS,oCAAoC,qBAA6C;AAC/F,MAAI,CAAC,oBAAqB,QAAO;AACjC,QAAM,gBAAgB,OAAO,mBAAmB;AAChD,MAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,EAAG,QAAO;AAClE,SAAO,iBAAkB,uCAAuC,IAAI;AACtE;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,cAAc;AACZ,UAAM,oDAAoD;AAC1D,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,4BAA4B,OAAoD;AAC9F,SAAO,iBAAiB;AAC1B;AAEA,eAAsB,wCAAwC,SAAqC;AACjG,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,UAAM,IAAI,0BAA0B;AAAA,EACtC;AAEA,MAAI,CAAC,QAAQ,KAAM,QAAO,QAAQ,SAAS;AAE3C,QAAM,WAAW,uCAAuC,IAAI;AAC5D,MAAI,gBAAgB;AACpB,QAAM,cAAc,QAAQ,KAAK,YAAY,IAAI,gBAAwC;AAAA,IACvF,UAAU,OAAO,YAAY;AAC3B,uBAAiB,MAAM;AACvB,UAAI,gBAAgB,UAAU;AAC5B,mBAAW,MAAM,IAAI,0BAA0B,CAAC;AAChD;AAAA,MACF;AACA,iBAAW,QAAQ,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC,CAAC;AACF,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc;AACtD,QAAM,UAAU,cAAc,EAAE,gBAAgB,YAAY,IAAI;AAChE,SAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,CAAC,EAAE,SAAS;AACzD;AAEO,SAAS,gCAAgC,mBAA2B,mBAAoC;AAC7G,SAAQ,oBAAoB,oBAAqB,kCAAkC;AACrF;",
+  "sourcesContent": ["const DEFAULT_ATTACHMENT_MAX_UPLOAD_MB = 25\nconst DEFAULT_ATTACHMENT_TENANT_QUOTA_MB = 512\nconst MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES = 1024 * 1024\nconst ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_MAX_UPLOAD_MB',\n  'OPENMERCATO_ATTACHMENT_MAX_UPLOAD_MB',\n] as const\nconst ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS = [\n  'OM_ATTACHMENT_TENANT_QUOTA_MB',\n  'OPENMERCATO_ATTACHMENT_TENANT_QUOTA_MB',\n] as const\n\nfunction readEnvValue(names: readonly string[]): string | undefined {\n  return names.map((name) => process.env[name]).find((value) => typeof value === 'string')\n}\n\nfunction parseMegabytesEnv(names: readonly string[], fallbackMb: number): number {\n  const raw = readEnvValue(names)\n  const parsed = raw ? Number(raw) : NaN\n  if (Number.isFinite(parsed) && parsed > 0) {\n    return parsed\n  }\n  return fallbackMb\n}\n\nexport function resolveDefaultAttachmentMaxUploadBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_MAX_UPLOAD_MB_ENV_KEYS, DEFAULT_ATTACHMENT_MAX_UPLOAD_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentTenantQuotaBytes(): number {\n  return Math.floor(parseMegabytesEnv(ATTACHMENT_TENANT_QUOTA_MB_ENV_KEYS, DEFAULT_ATTACHMENT_TENANT_QUOTA_MB) * 1024 * 1024)\n}\n\nexport function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | null): number {\n  const defaultMaxBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (typeof fieldMaxAttachmentSizeMb !== 'number' || fieldMaxAttachmentSizeMb <= 0) {\n    return defaultMaxBytes\n  }\n  return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))\n}\n\nexport function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {\n  if (!contentLengthHeader) return true\n  const contentLength = Number(contentLengthHeader)\n  if (!Number.isFinite(contentLength) || contentLength <= 0) return true\n  return contentLength <= (resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES)\n}\n\nexport function willExceedAttachmentTenantQuota(currentUsageBytes: number, incomingFileBytes: number): boolean {\n  return (currentUsageBytes + incomingFileBytes) > resolveAttachmentTenantQuotaBytes()\n}\n"],
+  "mappings": "AAAA,MAAM,mCAAmC;AACzC,MAAM,qCAAqC;AAC3C,MAAM,0CAA0C,OAAO;AACvD,MAAM,oCAAoC;AAAA,EACxC;AAAA,EACA;AACF;AACA,MAAM,sCAAsC;AAAA,EAC1C;AAAA,EACA;AACF;AAEA,SAAS,aAAa,OAA8C;AAClE,SAAO,MAAM,IAAI,CAAC,SAAS,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ;AACzF;AAEA,SAAS,kBAAkB,OAA0B,YAA4B;AAC/E,QAAM,MAAM,aAAa,KAAK;AAC9B,QAAM,SAAS,MAAM,OAAO,GAAG,IAAI;AACnC,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,yCAAiD;AAC/D,SAAO,KAAK,MAAM,kBAAkB,mCAAmC,gCAAgC,IAAI,OAAO,IAAI;AACxH;AAEO,SAAS,oCAA4C;AAC1D,SAAO,KAAK,MAAM,kBAAkB,qCAAqC,kCAAkC,IAAI,OAAO,IAAI;AAC5H;AAEO,SAAS,0BAA0B,0BAAkD;AAC1F,QAAM,kBAAkB,uCAAuC;AAC/D,MAAI,OAAO,6BAA6B,YAAY,4BAA4B,GAAG;AACjF,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,iBAAiB,KAAK,MAAM,2BAA2B,OAAO,IAAI,CAAC;AACrF;AAEO,SAAS,oCAAoC,qBAA6C;AAC/F,MAAI,CAAC,oBAAqB,QAAO;AACjC,QAAM,gBAAgB,OAAO,mBAAmB;AAChD,MAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,EAAG,QAAO;AAClE,SAAO,iBAAkB,uCAAuC,IAAI;AACtE;AAEO,SAAS,gCAAgC,mBAA2B,mBAAoC;AAC7G,SAAQ,oBAAoB,oBAAqB,kCAAkC;AACrF;",
   "names": []
 }

package/dist/modules/audit_logs/api/audit-logs/access/route.js

@@ -3,7 +3,6 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { loadAuditLogDisplayMaps } from "../display.js";
-import { requireResolvedTenantScope } from "../readScope.js";
 import { z } from "zod";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["audit_logs.view_self"] }
@@ -62,8 +61,6 @@ function parseNumber(param, { min, max, fallback }) {
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const tenantScopeGuard = requireResolvedTenantScope(auth);
-  if (tenantScopeGuard) return tenantScopeGuard;
   const container = await createRequestContainer();
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req });
   const rbac = container.resolve("rbacService");
@@ -155,8 +152,7 @@ const openApi = {
       ],
       errors: [
         { status: 400, description: "Invalid filters supplied", schema: errorSchema },
-        { status: 401, description: "Authentication required", schema: errorSchema },
-        { status: 403, description: "Caller has no resolved tenant scope and is not a superadmin", schema: errorSchema }
+        { status: 401, description: "Authentication required", schema: errorSchema }
       ]
     }
   }

package/dist/modules/audit_logs/api/audit-logs/access/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/audit_logs/api/audit-logs/access/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { AccessLogService } from '@open-mercato/core/modules/audit_logs/services/accessLogService'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { loadAuditLogDisplayMaps } from '../display'\nimport { requireResolvedTenantScope } from '../readScope'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },\n}\n\nconst auditAccessQuerySchema = z.object({\n  organizationId: z.string().uuid().describe('Limit results to a specific organization').optional(),\n  actorUserId: z.string().uuid().describe('Filter by actor user id (tenant administrators only)').optional(),\n  resourceKind: z.string().describe('Restrict to a resource kind such as `order` or `product`').optional(),\n  accessType: z.string().describe('Access type filter, e.g. `read` or `export`').optional(),\n  page: z.string().describe('Page number (default 1)').optional(),\n  pageSize: z.string().describe('Page size (default 50)').optional(),\n  limit: z.string().describe('Explicit maximum number of records when paginating manually').optional(),\n  before: z.string().describe('Return logs created before this ISO-8601 timestamp').optional(),\n  after: z.string().describe('Return logs created after this ISO-8601 timestamp').optional(),\n})\n\nconst auditAccessItemSchema = z.object({\n  id: z.string(),\n  resourceKind: z.string(),\n  resourceId: z.string(),\n  accessType: z.string(),\n  actorUserId: z.string().uuid().nullable(),\n  actorUserName: z.string().nullable(),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  fields: z.array(z.string()),\n  context: z.record(z.string(), z.unknown()).nullable(),\n  createdAt: z.string(),\n})\n\nconst auditAccessResponseSchema = z.object({\n  items: z.array(auditAccessItemSchema),\n  canViewTenant: z.boolean(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  total: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction parseDate(value: string | null): Date | undefined {\n  if (!value) return undefined\n  const ts = Date.parse(value)\n  if (Number.isNaN(ts)) return undefined\n  return new Date(ts)\n}\n\nfunction parseNumber(param: string | null, { min, max, fallback }: { min: number; max: number; fallback: number }) {\n  if (!param) return fallback\n  const value = Number(param)\n  if (!Number.isFinite(value)) return fallback\n  const normalized = Math.trunc(value)\n  if (Number.isNaN(normalized)) return fallback\n  return Math.min(Math.max(normalized, min), max)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const tenantScopeGuard = requireResolvedTenantScope(auth)\n  if (tenantScopeGuard) return tenantScopeGuard\n\n  const container = await createRequestContainer()\n  const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const rbac = (container.resolve('rbacService') as RbacService)\n  const accessLogs = (container.resolve('accessLogService') as AccessLogService)\n  const em = (container.resolve('em') as EntityManager)\n\n  const canViewTenant = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['audit_logs.view_tenant'],\n    { tenantId: auth.tenantId ?? null, organizationId: defaultOrganizationId ?? null },\n  )\n\n  const url = new URL(req.url)\n  const queryOrgId = url.searchParams.get('organizationId')\n  const actorQuery = url.searchParams.get('actorUserId')\n  const resourceKind = url.searchParams.get('resourceKind')\n  const accessType = url.searchParams.get('accessType')\n  const page = parseNumber(url.searchParams.get('page'), { min: 1, max: 1000000, fallback: 1 })\n  const pageSize = parseNumber(url.searchParams.get('pageSize'), { min: 1, max: 200, fallback: 50 })\n  const before = parseDate(url.searchParams.get('before'))\n  const after = parseDate(url.searchParams.get('after'))\n\n  let organizationId = defaultOrganizationId\n  if (queryOrgId) {\n    if (scope.allowedIds === null || scope.allowedIds.includes(queryOrgId)) {\n      organizationId = queryOrgId\n    }\n  }\n\n  let actorUserId = auth.sub\n  if (canViewTenant && actorQuery) {\n    actorUserId = actorQuery\n  }\n\n  let list: Awaited<ReturnType<AccessLogService['list']>>\n  try {\n    list = await accessLogs.list({\n      tenantId: auth.tenantId ?? undefined,\n      organizationId: organizationId ?? undefined,\n      actorUserId,\n      resourceKind: resourceKind ?? undefined,\n      accessType: accessType ?? undefined,\n      page,\n      pageSize,\n      limit: url.searchParams.get('limit') ? parseNumber(url.searchParams.get('limit'), { min: 1, max: 200, fallback: pageSize }) : undefined,\n      before,\n      after,\n    })\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })\n    }\n    throw err\n  }\n\n  const displayMaps = await loadAuditLogDisplayMaps(em, {\n    userIds: list.items.map((entry) => entry.actorUserId).filter((value): value is string => !!value),\n    tenantIds: list.items.map((entry) => entry.tenantId).filter((value): value is string => !!value),\n    organizationIds: list.items.map((entry) => entry.organizationId).filter((value): value is string => !!value),\n  })\n\n  const items = list.items.map((entry) => ({\n    id: entry.id,\n    resourceKind: entry.resourceKind,\n    resourceId: entry.resourceId,\n    accessType: entry.accessType,\n    actorUserId: entry.actorUserId,\n    actorUserName: entry.actorUserId ? displayMaps.users[entry.actorUserId] ?? null : null,\n    tenantId: entry.tenantId,\n    tenantName: entry.tenantId ? displayMaps.tenants[entry.tenantId] ?? null : null,\n    organizationId: entry.organizationId,\n    organizationName: entry.organizationId ? displayMaps.organizations[entry.organizationId] ?? null : null,\n    fields: entry.fieldsJson ?? [],\n    context: entry.contextJson,\n    createdAt: entry.createdAt?.toISOString?.() ?? entry.createdAt,\n  }))\n\n  return NextResponse.json({\n    items,\n    canViewTenant,\n    page: list.page,\n    pageSize: list.pageSize,\n    total: list.total,\n    totalPages: list.totalPages,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List access audit logs',\n  description: 'Retrieve read-only audit log entries detailing resource access within the current tenant or organization.',\n  methods: {\n    GET: {\n      summary: 'Retrieve access logs',\n      description:\n        'Fetches paginated access audit logs scoped to the authenticated user. Tenant administrators can optionally expand the search to other actors or organizations.',\n      query: auditAccessQuerySchema,\n      responses: [\n        { status: 200, description: 'Access logs returned successfully', schema: auditAccessResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid filters supplied', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,kCAAkC;AAI3C,SAAS,+BAA+B;AACxC,SAAS,kCAAkC;AAC3C,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0CAA0C,EAAE,SAAS;AAAA,EAChG,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,sDAAsD,EAAE,SAAS;AAAA,EACzG,cAAc,EAAE,OAAO,EAAE,SAAS,0DAA0D,EAAE,SAAS;AAAA,EACvG,YAAY,EAAE,OAAO,EAAE,SAAS,6CAA6C,EAAE,SAAS;AAAA,EACxF,MAAM,EAAE,OAAO,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAC9D,UAAU,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,SAAS;AAAA,EACjE,OAAO,EAAE,OAAO,EAAE,SAAS,6DAA6D,EAAE,SAAS;AAAA,EACnG,QAAQ,EAAE,OAAO,EAAE,SAAS,oDAAoD,EAAE,SAAS;AAAA,EAC3F,OAAO,EAAE,OAAO,EAAE,SAAS,mDAAmD,EAAE,SAAS;AAC3F,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO;AAAA,EACb,cAAc,EAAE,OAAO;AAAA,EACvB,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpD,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,QAAQ;AAAA,EACzB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,UAAU,OAAwC;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,IAAI,KAAK,EAAE;AACpB;AAEA,SAAS,YAAY,OAAsB,EAAE,KAAK,KAAK,SAAS,GAAmD;AACjH,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,QAAM,aAAa,KAAK,MAAM,KAAK;AACnC,MAAI,OAAO,MAAM,UAAU,EAAG,QAAO;AACrC,SAAO,KAAK,IAAI,KAAK,IAAI,YAAY,GAAG,GAAG,GAAG;AAChD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,mBAAmB,2BAA2B,IAAI;AACxD,MAAI,iBAAkB,QAAO;AAE7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE3H,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,aAAc,UAAU,QAAQ,kBAAkB;AACxD,QAAM,KAAM,UAAU,QAAQ,IAAI;AAElC,QAAM,gBAAgB,MAAM,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,CAAC,wBAAwB;AAAA,IACzB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,yBAAyB,KAAK;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,gBAAgB;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,aAAa;AACrD,QAAM,eAAe,IAAI,aAAa,IAAI,cAAc;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,YAAY;AACpD,QAAM,OAAO,YAAY,IAAI,aAAa,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG,KAAK,KAAS,UAAU,EAAE,CAAC;AAC5F,QAAM,WAAW,YAAY,IAAI,aAAa,IAAI,UAAU,GAAG,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,GAAG,CAAC;AACjG,QAAM,SAAS,UAAU,IAAI,aAAa,IAAI,QAAQ,CAAC;AACvD,QAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC;AAErD,MAAI,iBAAiB;AACrB,MAAI,YAAY;AACd,QAAI,MAAM,eAAe,QAAQ,MAAM,WAAW,SAAS,UAAU,GAAG;AACtE,uBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,MAAI,cAAc,KAAK;AACvB,MAAI,iBAAiB,YAAY;AAC/B,kBAAc;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,WAAW,KAAK;AAAA,MAC3B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,kBAAkB;AAAA,MAClC;AAAA,MACA,cAAc,gBAAgB;AAAA,MAC9B,YAAY,cAAc;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,OAAO,IAAI,aAAa,IAAI,OAAO,IAAI,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,SAAS,CAAC,IAAI;AAAA,MAC9H;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AACA,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,IACpD,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,WAAW,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAChG,WAAW,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/F,iBAAiB,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,cAAc,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,EAC7G,CAAC;AAED,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW;AAAA,IACvC,IAAI,MAAM;AAAA,IACV,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,aAAa,MAAM;AAAA,IACnB,eAAe,MAAM,cAAc,YAAY,MAAM,MAAM,WAAW,KAAK,OAAO;AAAA,IAClF,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM,WAAW,YAAY,QAAQ,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC3E,gBAAgB,MAAM;AAAA,IACtB,kBAAkB,MAAM,iBAAiB,YAAY,cAAc,MAAM,cAAc,KAAK,OAAO;AAAA,IACnG,QAAQ,MAAM,cAAc,CAAC;AAAA,IAC7B,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,EACvD,EAAE;AAEF,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,YAAY,KAAK;AAAA,EACnB,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,0BAA0B;AAAA,MACrG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,YAAY;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { AccessLogService } from '@open-mercato/core/modules/audit_logs/services/accessLogService'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { loadAuditLogDisplayMaps } from '../display'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },\n}\n\nconst auditAccessQuerySchema = z.object({\n  organizationId: z.string().uuid().describe('Limit results to a specific organization').optional(),\n  actorUserId: z.string().uuid().describe('Filter by actor user id (tenant administrators only)').optional(),\n  resourceKind: z.string().describe('Restrict to a resource kind such as `order` or `product`').optional(),\n  accessType: z.string().describe('Access type filter, e.g. `read` or `export`').optional(),\n  page: z.string().describe('Page number (default 1)').optional(),\n  pageSize: z.string().describe('Page size (default 50)').optional(),\n  limit: z.string().describe('Explicit maximum number of records when paginating manually').optional(),\n  before: z.string().describe('Return logs created before this ISO-8601 timestamp').optional(),\n  after: z.string().describe('Return logs created after this ISO-8601 timestamp').optional(),\n})\n\nconst auditAccessItemSchema = z.object({\n  id: z.string(),\n  resourceKind: z.string(),\n  resourceId: z.string(),\n  accessType: z.string(),\n  actorUserId: z.string().uuid().nullable(),\n  actorUserName: z.string().nullable(),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  fields: z.array(z.string()),\n  context: z.record(z.string(), z.unknown()).nullable(),\n  createdAt: z.string(),\n})\n\nconst auditAccessResponseSchema = z.object({\n  items: z.array(auditAccessItemSchema),\n  canViewTenant: z.boolean(),\n  page: z.number().int(),\n  pageSize: z.number().int(),\n  total: z.number().int(),\n  totalPages: z.number().int(),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction parseDate(value: string | null): Date | undefined {\n  if (!value) return undefined\n  const ts = Date.parse(value)\n  if (Number.isNaN(ts)) return undefined\n  return new Date(ts)\n}\n\nfunction parseNumber(param: string | null, { min, max, fallback }: { min: number; max: number; fallback: number }) {\n  if (!param) return fallback\n  const value = Number(param)\n  if (!Number.isFinite(value)) return fallback\n  const normalized = Math.trunc(value)\n  if (Number.isNaN(normalized)) return fallback\n  return Math.min(Math.max(normalized, min), max)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const rbac = (container.resolve('rbacService') as RbacService)\n  const accessLogs = (container.resolve('accessLogService') as AccessLogService)\n  const em = (container.resolve('em') as EntityManager)\n\n  const canViewTenant = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['audit_logs.view_tenant'],\n    { tenantId: auth.tenantId ?? null, organizationId: defaultOrganizationId ?? null },\n  )\n\n  const url = new URL(req.url)\n  const queryOrgId = url.searchParams.get('organizationId')\n  const actorQuery = url.searchParams.get('actorUserId')\n  const resourceKind = url.searchParams.get('resourceKind')\n  const accessType = url.searchParams.get('accessType')\n  const page = parseNumber(url.searchParams.get('page'), { min: 1, max: 1000000, fallback: 1 })\n  const pageSize = parseNumber(url.searchParams.get('pageSize'), { min: 1, max: 200, fallback: 50 })\n  const before = parseDate(url.searchParams.get('before'))\n  const after = parseDate(url.searchParams.get('after'))\n\n  let organizationId = defaultOrganizationId\n  if (queryOrgId) {\n    if (scope.allowedIds === null || scope.allowedIds.includes(queryOrgId)) {\n      organizationId = queryOrgId\n    }\n  }\n\n  let actorUserId = auth.sub\n  if (canViewTenant && actorQuery) {\n    actorUserId = actorQuery\n  }\n\n  let list: Awaited<ReturnType<AccessLogService['list']>>\n  try {\n    list = await accessLogs.list({\n      tenantId: auth.tenantId ?? undefined,\n      organizationId: organizationId ?? undefined,\n      actorUserId,\n      resourceKind: resourceKind ?? undefined,\n      accessType: accessType ?? undefined,\n      page,\n      pageSize,\n      limit: url.searchParams.get('limit') ? parseNumber(url.searchParams.get('limit'), { min: 1, max: 200, fallback: pageSize }) : undefined,\n      before,\n      after,\n    })\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })\n    }\n    throw err\n  }\n\n  const displayMaps = await loadAuditLogDisplayMaps(em, {\n    userIds: list.items.map((entry) => entry.actorUserId).filter((value): value is string => !!value),\n    tenantIds: list.items.map((entry) => entry.tenantId).filter((value): value is string => !!value),\n    organizationIds: list.items.map((entry) => entry.organizationId).filter((value): value is string => !!value),\n  })\n\n  const items = list.items.map((entry) => ({\n    id: entry.id,\n    resourceKind: entry.resourceKind,\n    resourceId: entry.resourceId,\n    accessType: entry.accessType,\n    actorUserId: entry.actorUserId,\n    actorUserName: entry.actorUserId ? displayMaps.users[entry.actorUserId] ?? null : null,\n    tenantId: entry.tenantId,\n    tenantName: entry.tenantId ? displayMaps.tenants[entry.tenantId] ?? null : null,\n    organizationId: entry.organizationId,\n    organizationName: entry.organizationId ? displayMaps.organizations[entry.organizationId] ?? null : null,\n    fields: entry.fieldsJson ?? [],\n    context: entry.contextJson,\n    createdAt: entry.createdAt?.toISOString?.() ?? entry.createdAt,\n  }))\n\n  return NextResponse.json({\n    items,\n    canViewTenant,\n    page: list.page,\n    pageSize: list.pageSize,\n    total: list.total,\n    totalPages: list.totalPages,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List access audit logs',\n  description: 'Retrieve read-only audit log entries detailing resource access within the current tenant or organization.',\n  methods: {\n    GET: {\n      summary: 'Retrieve access logs',\n      description:\n        'Fetches paginated access audit logs scoped to the authenticated user. Tenant administrators can optionally expand the search to other actors or organizations.',\n      query: auditAccessQuerySchema,\n      responses: [\n        { status: 200, description: 'Access logs returned successfully', schema: auditAccessResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid filters supplied', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,kCAAkC;AAI3C,SAAS,+BAA+B;AACxC,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0CAA0C,EAAE,SAAS;AAAA,EAChG,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,sDAAsD,EAAE,SAAS;AAAA,EACzG,cAAc,EAAE,OAAO,EAAE,SAAS,0DAA0D,EAAE,SAAS;AAAA,EACvG,YAAY,EAAE,OAAO,EAAE,SAAS,6CAA6C,EAAE,SAAS;AAAA,EACxF,MAAM,EAAE,OAAO,EAAE,SAAS,yBAAyB,EAAE,SAAS;AAAA,EAC9D,UAAU,EAAE,OAAO,EAAE,SAAS,wBAAwB,EAAE,SAAS;AAAA,EACjE,OAAO,EAAE,OAAO,EAAE,SAAS,6DAA6D,EAAE,SAAS;AAAA,EACnG,QAAQ,EAAE,OAAO,EAAE,SAAS,oDAAoD,EAAE,SAAS;AAAA,EAC3F,OAAO,EAAE,OAAO,EAAE,SAAS,mDAAmD,EAAE,SAAS;AAC3F,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO;AAAA,EACb,cAAc,EAAE,OAAO;AAAA,EACvB,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpD,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,QAAQ;AAAA,EACzB,MAAM,EAAE,OAAO,EAAE,IAAI;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,OAAO,EAAE,OAAO,EAAE,IAAI;AAAA,EACtB,YAAY,EAAE,OAAO,EAAE,IAAI;AAC7B,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,UAAU,OAAwC;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,SAAO,IAAI,KAAK,EAAE;AACpB;AAEA,SAAS,YAAY,OAAsB,EAAE,KAAK,KAAK,SAAS,GAAmD;AACjH,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,QAAM,aAAa,KAAK,MAAM,KAAK;AACnC,MAAI,OAAO,MAAM,UAAU,EAAG,QAAO;AACrC,SAAO,KAAK,IAAI,KAAK,IAAI,YAAY,GAAG,GAAG,GAAG;AAChD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE3H,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,aAAc,UAAU,QAAQ,kBAAkB;AACxD,QAAM,KAAM,UAAU,QAAQ,IAAI;AAElC,QAAM,gBAAgB,MAAM,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,CAAC,wBAAwB;AAAA,IACzB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,yBAAyB,KAAK;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,gBAAgB;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,aAAa;AACrD,QAAM,eAAe,IAAI,aAAa,IAAI,cAAc;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,YAAY;AACpD,QAAM,OAAO,YAAY,IAAI,aAAa,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG,KAAK,KAAS,UAAU,EAAE,CAAC;AAC5F,QAAM,WAAW,YAAY,IAAI,aAAa,IAAI,UAAU,GAAG,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,GAAG,CAAC;AACjG,QAAM,SAAS,UAAU,IAAI,aAAa,IAAI,QAAQ,CAAC;AACvD,QAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC;AAErD,MAAI,iBAAiB;AACrB,MAAI,YAAY;AACd,QAAI,MAAM,eAAe,QAAQ,MAAM,WAAW,SAAS,UAAU,GAAG;AACtE,uBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,MAAI,cAAc,KAAK;AACvB,MAAI,iBAAiB,YAAY;AAC/B,kBAAc;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,WAAW,KAAK;AAAA,MAC3B,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,kBAAkB;AAAA,MAClC;AAAA,MACA,cAAc,gBAAgB;AAAA,MAC9B,YAAY,cAAc;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,OAAO,IAAI,aAAa,IAAI,OAAO,IAAI,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,SAAS,CAAC,IAAI;AAAA,MAC9H;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AACA,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,IACpD,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,WAAW,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAChG,WAAW,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,QAAQ,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/F,iBAAiB,KAAK,MAAM,IAAI,CAAC,UAAU,MAAM,cAAc,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,EAC7G,CAAC;AAED,QAAM,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW;AAAA,IACvC,IAAI,MAAM;AAAA,IACV,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,aAAa,MAAM;AAAA,IACnB,eAAe,MAAM,cAAc,YAAY,MAAM,MAAM,WAAW,KAAK,OAAO;AAAA,IAClF,UAAU,MAAM;AAAA,IAChB,YAAY,MAAM,WAAW,YAAY,QAAQ,MAAM,QAAQ,KAAK,OAAO;AAAA,IAC3E,gBAAgB,MAAM;AAAA,IACtB,kBAAkB,MAAM,iBAAiB,YAAY,cAAc,MAAM,cAAc,KAAK,OAAO;AAAA,IACnG,QAAQ,MAAM,cAAc,CAAC;AAAA,IAC7B,SAAS,MAAM;AAAA,IACf,WAAW,MAAM,WAAW,cAAc,KAAK,MAAM;AAAA,EACvD,EAAE;AAEF,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,YAAY,KAAK;AAAA,EACnB,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,0BAA0B;AAAA,MACrG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/audit_logs/api/audit-logs/actions/export/route.js

@@ -12,7 +12,6 @@ import {
   deriveActionLogSource
 } from "@open-mercato/core/modules/audit_logs/lib/projections";
 import { loadAuditLogDisplayMaps } from "../../display.js";
-import { requireResolvedTenantScope } from "../../readScope.js";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["audit_logs.view_self"] }
 };
@@ -71,8 +70,6 @@ function formatValue(value) {
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const tenantScopeGuard = requireResolvedTenantScope(auth);
-  if (tenantScopeGuard) return tenantScopeGuard;
   const container = await createRequestContainer();
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req });
   const rbac = container.resolve("rbacService");
@@ -206,8 +203,7 @@ const openApi = {
       ],
       errors: [
         { status: 400, description: "Invalid filter values", schema: errorSchema },
-        { status: 401, description: "Authentication required", schema: errorSchema },
-        { status: 403, description: "Caller has no resolved tenant scope and is not a superadmin", schema: errorSchema }
+        { status: 401, description: "Authentication required", schema: errorSchema }
       ]
     }
   }

package/dist/modules/audit_logs/api/audit-logs/actions/export/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/audit_logs/api/audit-logs/actions/export/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { defaultExportFilename, serializeExport, type PreparedExport } from '@open-mercato/shared/lib/crud/exporters'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { extractChangeRows } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  deriveActionLogActionType,\n  deriveActionLogSource,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '../../display'\nimport { requireResolvedTenantScope } from '../../readScope'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },\n}\n\nconst ACTION_TYPE_TOKENS = ACTION_LOG_FILTER_TYPES\nconst SORT_FIELDS = ['createdAt', 'user', 'action', 'field', 'source'] as const\nconst SORT_DIRECTIONS = ['asc', 'desc'] as const\n\nconst exportQuerySchema = z.object({\n  organizationId: z.string().uuid().describe('Limit results to a specific organization').optional(),\n  actorUserId: z\n    .string()\n    .describe('Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list.')\n    .optional(),\n  resourceKind: z.string().describe('Filter by resource kind (e.g., \"order\", \"product\")').optional(),\n  resourceId: z.string().describe('Filter by resource ID (UUID of the specific record)').optional(),\n  actionType: z\n    .string()\n    .describe('Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list.')\n    .optional(),\n  fieldName: z\n    .string()\n    .describe('Filter to entries where the given field changed. Accepts a single field name or a comma-separated list.')\n    .optional(),\n  includeRelated: z\n    .enum(['true', 'false'])\n    .default('false')\n    .describe('When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId')\n    .optional(),\n  undoableOnly: z\n    .enum(['true', 'false'])\n    .default('false')\n    .describe('When `true`, only undoable actions are returned')\n    .optional(),\n  limit: z.string().describe('Maximum number of records to export (default 1000, capped at 1000)').optional(),\n  sortField: z\n    .enum(SORT_FIELDS)\n    .describe('Sort field: `createdAt`, `user`, `action`, `field`, or `source`.')\n    .optional(),\n  sortDir: z\n    .enum(SORT_DIRECTIONS)\n    .describe('Sort direction: `asc` or `desc`.')\n    .optional(),\n  before: z.string().describe('Return actions created before this ISO-8601 timestamp').optional(),\n  after: z.string().describe('Return actions created after this ISO-8601 timestamp').optional(),\n})\n\nconst responseSchema = z.object({\n  file: z.literal('csv'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction splitCsv(value: string | null): string[] {\n  if (!value) return []\n  return value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter(Boolean)\n}\n\nfunction parseActionTypes(param: string | null) {\n  return splitCsv(param).filter((value): value is (typeof ACTION_TYPE_TOKENS)[number] =>\n    ACTION_TYPE_TOKENS.includes(value as (typeof ACTION_TYPE_TOKENS)[number]),\n  )\n}\n\nfunction parseLimit(param: string | null): number {\n  if (!param) return 1000\n  const value = Number(param)\n  if (!Number.isFinite(value)) return 1000\n  return Math.min(Math.max(Math.trunc(value), 1), 1000)\n}\n\nfunction parseDate(value: string | null): Date | undefined {\n  if (!value) return undefined\n  const timestamp = Date.parse(value)\n  if (Number.isNaN(timestamp)) return undefined\n  return new Date(timestamp)\n}\n\nfunction formatValue(value: unknown): string {\n  if (value == null) return ''\n  if (value instanceof Date) return value.toISOString()\n  if (Array.isArray(value)) return value.map((entry) => formatValue(entry)).filter(Boolean).join(', ')\n  if (typeof value === 'object') return JSON.stringify(value)\n  return String(value)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const tenantScopeGuard = requireResolvedTenantScope(auth)\n  if (tenantScopeGuard) return tenantScopeGuard\n\n  const container = await createRequestContainer()\n  const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })\n  const rbac = container.resolve('rbacService') as RbacService\n  const actionLogs = container.resolve('actionLogService') as ActionLogService\n  const em = container.resolve('em') as EntityManager\n\n  const canViewTenant = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['audit_logs.view_tenant'],\n    { tenantId: auth.tenantId ?? null, organizationId: defaultOrganizationId ?? null },\n  )\n\n  const url = new URL(req.url)\n  const queryOrgId = url.searchParams.get('organizationId')\n  const actorQuery = url.searchParams.get('actorUserId')\n  const resourceKind = url.searchParams.get('resourceKind') ?? undefined\n  const resourceId = url.searchParams.get('resourceId') ?? undefined\n  const actionTypes = parseActionTypes(url.searchParams.get('actionType'))\n  const fieldNames = splitCsv(url.searchParams.get('fieldName'))\n  const includeRelated = parseBooleanToken(url.searchParams.get('includeRelated')) === true\n  const undoableOnly = parseBooleanToken(url.searchParams.get('undoableOnly')) === true\n  const limit = parseLimit(url.searchParams.get('limit'))\n  const sortField = SORT_FIELDS.find((value) => value === url.searchParams.get('sortField')) ?? 'createdAt'\n  const sortDir = SORT_DIRECTIONS.find((value) => value === url.searchParams.get('sortDir')) ?? 'desc'\n  const before = parseDate(url.searchParams.get('before'))\n  const after = parseDate(url.searchParams.get('after'))\n\n  let organizationId = defaultOrganizationId\n  if (queryOrgId) {\n    if (scope.allowedIds === null || scope.allowedIds.includes(queryOrgId)) {\n      organizationId = queryOrgId\n    }\n  }\n\n  let actorUserId: string | undefined = canViewTenant ? undefined : auth.sub\n  let actorUserIds: string[] | undefined\n  if (canViewTenant && actorQuery) {\n    const parsedActorUserIds = splitCsv(actorQuery)\n    if (parsedActorUserIds.length === 1) {\n      actorUserId = parsedActorUserIds[0]\n    } else if (parsedActorUserIds.length > 1) {\n      actorUserId = undefined\n      actorUserIds = parsedActorUserIds\n    }\n  }\n\n  let entriesResult: Awaited<ReturnType<ActionLogService['list']>>\n  try {\n    entriesResult = await actionLogs.list({\n      tenantId: auth.tenantId ?? undefined,\n      organizationId: organizationId ?? undefined,\n      actorUserId,\n      actorUserIds,\n      resourceKind,\n      resourceId,\n      actionTypes,\n      fieldNames,\n      includeRelated,\n      undoableOnly,\n      sortField,\n      sortDir,\n      limit,\n      before,\n      after,\n    })\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })\n    }\n    throw err\n  }\n  const entries = entriesResult.items\n\n  const displayMaps = await loadAuditLogDisplayMaps(em, {\n    userIds: entries.map((entry: any) => entry.actorUserId).filter((value: any): value is string => Boolean(value)),\n    tenantIds: entries.map((entry: any) => entry.tenantId).filter((value: any): value is string => Boolean(value)),\n    organizationIds: entries.map((entry: any) => entry.organizationId).filter((value: any): value is string => Boolean(value)),\n  })\n\n  const rows = entries.flatMap((entry: any) => {\n    const actionType = deriveActionLogActionType(entry)\n    const actionLabel = actionType === 'system'\n      ? entry.actionLabel ?? 'System'\n      : actionType.charAt(0).toUpperCase() + actionType.slice(1)\n    const baseRow = {\n      when: entry.createdAt?.toISOString?.() ?? '',\n      user: entry.actorUserId ? displayMaps.users[entry.actorUserId] ?? entry.actorUserId : 'System',\n      action: actionLabel,\n      source: deriveActionLogSource(entry.contextJson, entry.actorUserId).toUpperCase(),\n    }\n    const changes = extractChangeRows(entry.changesJson, entry.snapshotBefore)\n\n    if (changes.length === 0) {\n      return [{\n        ...baseRow,\n        field: '',\n        oldValue: '',\n        newValue: '',\n      }]\n    }\n\n    return changes.map((change) => {\n      return {\n        ...baseRow,\n        field: change.field,\n        oldValue: formatValue(change.from),\n        newValue: formatValue(change.to),\n      }\n    })\n  })\n\n  const prepared: PreparedExport = {\n    columns: [\n      { field: 'when', header: 'When' },\n      { field: 'user', header: 'User' },\n      { field: 'action', header: 'Action' },\n      { field: 'field', header: 'Field' },\n      { field: 'oldValue', header: 'Old Value' },\n      { field: 'newValue', header: 'New Value' },\n      { field: 'source', header: 'Source' },\n    ],\n    rows,\n  }\n\n  const serialized = serializeExport(prepared, 'csv')\n  const filename = defaultExportFilename('changelog-export', 'csv')\n\n  return new Response(serialized.body, {\n    headers: {\n      'content-type': serialized.contentType,\n      'content-disposition': `attachment; filename=\"${filename}\"`,\n    },\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Export action audit logs',\n  description: 'Exports filtered action audit log entries for the current tenant as CSV.',\n  methods: {\n    GET: {\n      summary: 'Export action logs as CSV',\n      description:\n        'Returns a CSV attachment containing filtered action audit log entries. Tenant administrators can widen the scope to other actors or organizations.',\n      query: exportQuerySchema,\n      responses: [\n        { status: 200, description: 'CSV export generated successfully', schema: responseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid filter values', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB,uBAA4C;AAE5E,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAE3C,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B;AACxC,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,MAAM,qBAAqB;AAC3B,MAAM,cAAc,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ;AACrE,MAAM,kBAAkB,CAAC,OAAO,MAAM;AAEtC,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0CAA0C,EAAE,SAAS;AAAA,EAChG,aAAa,EACV,OAAO,EACP,SAAS,+HAA+H,EACxI,SAAS;AAAA,EACZ,cAAc,EAAE,OAAO,EAAE,SAAS,oDAAoD,EAAE,SAAS;AAAA,EACjG,YAAY,EAAE,OAAO,EAAE,SAAS,qDAAqD,EAAE,SAAS;AAAA,EAChG,YAAY,EACT,OAAO,EACP,SAAS,iHAAiH,EAC1H,SAAS;AAAA,EACZ,WAAW,EACR,OAAO,EACP,SAAS,yGAAyG,EAClH,SAAS;AAAA,EACZ,gBAAgB,EACb,KAAK,CAAC,QAAQ,OAAO,CAAC,EACtB,QAAQ,OAAO,EACf,SAAS,oGAAoG,EAC7G,SAAS;AAAA,EACZ,cAAc,EACX,KAAK,CAAC,QAAQ,OAAO,CAAC,EACtB,QAAQ,OAAO,EACf,SAAS,iDAAiD,EAC1D,SAAS;AAAA,EACZ,OAAO,EAAE,OAAO,EAAE,SAAS,oEAAoE,EAAE,SAAS;AAAA,EAC1G,WAAW,EACR,KAAK,WAAW,EAChB,SAAS,kEAAkE,EAC3E,SAAS;AAAA,EACZ,SAAS,EACN,KAAK,eAAe,EACpB,SAAS,kCAAkC,EAC3C,SAAS;AAAA,EACZ,QAAQ,EAAE,OAAO,EAAE,SAAS,uDAAuD,EAAE,SAAS;AAAA,EAC9F,OAAO,EAAE,OAAO,EAAE,SAAS,sDAAsD,EAAE,SAAS;AAC9F,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,KAAK;AACvB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,SAAS,OAAgC;AAChD,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,SAAS,iBAAiB,OAAsB;AAC9C,SAAO,SAAS,KAAK,EAAE;AAAA,IAAO,CAAC,UAC7B,mBAAmB,SAAS,KAA4C;AAAA,EAC1E;AACF;AAEA,SAAS,WAAW,OAA8B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,KAAK,GAAG,CAAC,GAAG,GAAI;AACtD;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,KAAK,MAAM,KAAK;AAClC,MAAI,OAAO,MAAM,SAAS,EAAG,QAAO;AACpC,SAAO,IAAI,KAAK,SAAS;AAC3B;AAEA,SAAS,YAAY,OAAwB;AAC3C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,UAAU,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACnG,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,mBAAmB,2BAA2B,IAAI;AACxD,MAAI,iBAAkB,QAAO;AAE7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAC3H,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,aAAa,UAAU,QAAQ,kBAAkB;AACvD,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,gBAAgB,MAAM,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,CAAC,wBAAwB;AAAA,IACzB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,yBAAyB,KAAK;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,gBAAgB;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,aAAa;AACrD,QAAM,eAAe,IAAI,aAAa,IAAI,cAAc,KAAK;AAC7D,QAAM,aAAa,IAAI,aAAa,IAAI,YAAY,KAAK;AACzD,QAAM,cAAc,iBAAiB,IAAI,aAAa,IAAI,YAAY,CAAC;AACvE,QAAM,aAAa,SAAS,IAAI,aAAa,IAAI,WAAW,CAAC;AAC7D,QAAM,iBAAiB,kBAAkB,IAAI,aAAa,IAAI,gBAAgB,CAAC,MAAM;AACrF,QAAM,eAAe,kBAAkB,IAAI,aAAa,IAAI,cAAc,CAAC,MAAM;AACjF,QAAM,QAAQ,WAAW,IAAI,aAAa,IAAI,OAAO,CAAC;AACtD,QAAM,YAAY,YAAY,KAAK,CAAC,UAAU,UAAU,IAAI,aAAa,IAAI,WAAW,CAAC,KAAK;AAC9F,QAAM,UAAU,gBAAgB,KAAK,CAAC,UAAU,UAAU,IAAI,aAAa,IAAI,SAAS,CAAC,KAAK;AAC9F,QAAM,SAAS,UAAU,IAAI,aAAa,IAAI,QAAQ,CAAC;AACvD,QAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC;AAErD,MAAI,iBAAiB;AACrB,MAAI,YAAY;AACd,QAAI,MAAM,eAAe,QAAQ,MAAM,WAAW,SAAS,UAAU,GAAG;AACtE,uBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,MAAI,cAAkC,gBAAgB,SAAY,KAAK;AACvE,MAAI;AACJ,MAAI,iBAAiB,YAAY;AAC/B,UAAM,qBAAqB,SAAS,UAAU;AAC9C,QAAI,mBAAmB,WAAW,GAAG;AACnC,oBAAc,mBAAmB,CAAC;AAAA,IACpC,WAAW,mBAAmB,SAAS,GAAG;AACxC,oBAAc;AACd,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,KAAK;AAAA,MACpC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,kBAAkB;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAE9B,QAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,IACpD,SAAS,QAAQ,IAAI,CAAC,UAAe,MAAM,WAAW,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,IAC9G,WAAW,QAAQ,IAAI,CAAC,UAAe,MAAM,QAAQ,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,IAC7G,iBAAiB,QAAQ,IAAI,CAAC,UAAe,MAAM,cAAc,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,EAC3H,CAAC;AAED,QAAM,OAAO,QAAQ,QAAQ,CAAC,UAAe;AAC3C,UAAM,aAAa,0BAA0B,KAAK;AAClD,UAAM,cAAc,eAAe,WAC/B,MAAM,eAAe,WACrB,WAAW,OAAO,CAAC,EAAE,YAAY,IAAI,WAAW,MAAM,CAAC;AAC3D,UAAM,UAAU;AAAA,MACd,MAAM,MAAM,WAAW,cAAc,KAAK;AAAA,MAC1C,MAAM,MAAM,cAAc,YAAY,MAAM,MAAM,WAAW,KAAK,MAAM,cAAc;AAAA,MACtF,QAAQ;AAAA,MACR,QAAQ,sBAAsB,MAAM,aAAa,MAAM,WAAW,EAAE,YAAY;AAAA,IAClF;AACA,UAAM,UAAU,kBAAkB,MAAM,aAAa,MAAM,cAAc;AAEzE,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,CAAC;AAAA,QACN,GAAG;AAAA,QACH,OAAO;AAAA,QACP,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,IAAI,CAAC,WAAW;AAC7B,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,OAAO;AAAA,QACd,UAAU,YAAY,OAAO,IAAI;AAAA,QACjC,UAAU,YAAY,OAAO,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,QAAM,WAA2B;AAAA,IAC/B,SAAS;AAAA,MACP,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAAA,MAChC,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAAA,MAChC,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,MACpC,EAAE,OAAO,SAAS,QAAQ,QAAQ;AAAA,MAClC,EAAE,OAAO,YAAY,QAAQ,YAAY;AAAA,MACzC,EAAE,OAAO,YAAY,QAAQ,YAAY;AAAA,MACzC,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,IACtC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,UAAU,KAAK;AAClD,QAAM,WAAW,sBAAsB,oBAAoB,KAAK;AAEhE,SAAO,IAAI,SAAS,WAAW,MAAM;AAAA,IACnC,SAAS;AAAA,MACP,gBAAgB,WAAW;AAAA,MAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,eAAe;AAAA,MAC1F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,+DAA+D,QAAQ,YAAY;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { defaultExportFilename, serializeExport, type PreparedExport } from '@open-mercato/shared/lib/crud/exporters'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { extractChangeRows } from '@open-mercato/core/modules/audit_logs/lib/changeRows'\nimport {\n  ACTION_LOG_FILTER_TYPES,\n  deriveActionLogActionType,\n  deriveActionLogSource,\n} from '@open-mercato/core/modules/audit_logs/lib/projections'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '../../display'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },\n}\n\nconst ACTION_TYPE_TOKENS = ACTION_LOG_FILTER_TYPES\nconst SORT_FIELDS = ['createdAt', 'user', 'action', 'field', 'source'] as const\nconst SORT_DIRECTIONS = ['asc', 'desc'] as const\n\nconst exportQuerySchema = z.object({\n  organizationId: z.string().uuid().describe('Limit results to a specific organization').optional(),\n  actorUserId: z\n    .string()\n    .describe('Filter logs created by specific actor IDs (tenant administrators only). Accepts a single UUID or a comma-separated UUID list.')\n    .optional(),\n  resourceKind: z.string().describe('Filter by resource kind (e.g., \"order\", \"product\")').optional(),\n  resourceId: z.string().describe('Filter by resource ID (UUID of the specific record)').optional(),\n  actionType: z\n    .string()\n    .describe('Filter by action type (`create`, `edit`, `delete`, `assign`). Accepts a single value or a comma-separated list.')\n    .optional(),\n  fieldName: z\n    .string()\n    .describe('Filter to entries where the given field changed. Accepts a single field name or a comma-separated list.')\n    .optional(),\n  includeRelated: z\n    .enum(['true', 'false'])\n    .default('false')\n    .describe('When `true`, also returns changes to child entities linked via parentResourceKind/parentResourceId')\n    .optional(),\n  undoableOnly: z\n    .enum(['true', 'false'])\n    .default('false')\n    .describe('When `true`, only undoable actions are returned')\n    .optional(),\n  limit: z.string().describe('Maximum number of records to export (default 1000, capped at 1000)').optional(),\n  sortField: z\n    .enum(SORT_FIELDS)\n    .describe('Sort field: `createdAt`, `user`, `action`, `field`, or `source`.')\n    .optional(),\n  sortDir: z\n    .enum(SORT_DIRECTIONS)\n    .describe('Sort direction: `asc` or `desc`.')\n    .optional(),\n  before: z.string().describe('Return actions created before this ISO-8601 timestamp').optional(),\n  after: z.string().describe('Return actions created after this ISO-8601 timestamp').optional(),\n})\n\nconst responseSchema = z.object({\n  file: z.literal('csv'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nfunction splitCsv(value: string | null): string[] {\n  if (!value) return []\n  return value\n    .split(',')\n    .map((entry) => entry.trim())\n    .filter(Boolean)\n}\n\nfunction parseActionTypes(param: string | null) {\n  return splitCsv(param).filter((value): value is (typeof ACTION_TYPE_TOKENS)[number] =>\n    ACTION_TYPE_TOKENS.includes(value as (typeof ACTION_TYPE_TOKENS)[number]),\n  )\n}\n\nfunction parseLimit(param: string | null): number {\n  if (!param) return 1000\n  const value = Number(param)\n  if (!Number.isFinite(value)) return 1000\n  return Math.min(Math.max(Math.trunc(value), 1), 1000)\n}\n\nfunction parseDate(value: string | null): Date | undefined {\n  if (!value) return undefined\n  const timestamp = Date.parse(value)\n  if (Number.isNaN(timestamp)) return undefined\n  return new Date(timestamp)\n}\n\nfunction formatValue(value: unknown): string {\n  if (value == null) return ''\n  if (value instanceof Date) return value.toISOString()\n  if (Array.isArray(value)) return value.map((entry) => formatValue(entry)).filter(Boolean).join(', ')\n  if (typeof value === 'object') return JSON.stringify(value)\n  return String(value)\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })\n  const rbac = container.resolve('rbacService') as RbacService\n  const actionLogs = container.resolve('actionLogService') as ActionLogService\n  const em = container.resolve('em') as EntityManager\n\n  const canViewTenant = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['audit_logs.view_tenant'],\n    { tenantId: auth.tenantId ?? null, organizationId: defaultOrganizationId ?? null },\n  )\n\n  const url = new URL(req.url)\n  const queryOrgId = url.searchParams.get('organizationId')\n  const actorQuery = url.searchParams.get('actorUserId')\n  const resourceKind = url.searchParams.get('resourceKind') ?? undefined\n  const resourceId = url.searchParams.get('resourceId') ?? undefined\n  const actionTypes = parseActionTypes(url.searchParams.get('actionType'))\n  const fieldNames = splitCsv(url.searchParams.get('fieldName'))\n  const includeRelated = parseBooleanToken(url.searchParams.get('includeRelated')) === true\n  const undoableOnly = parseBooleanToken(url.searchParams.get('undoableOnly')) === true\n  const limit = parseLimit(url.searchParams.get('limit'))\n  const sortField = SORT_FIELDS.find((value) => value === url.searchParams.get('sortField')) ?? 'createdAt'\n  const sortDir = SORT_DIRECTIONS.find((value) => value === url.searchParams.get('sortDir')) ?? 'desc'\n  const before = parseDate(url.searchParams.get('before'))\n  const after = parseDate(url.searchParams.get('after'))\n\n  let organizationId = defaultOrganizationId\n  if (queryOrgId) {\n    if (scope.allowedIds === null || scope.allowedIds.includes(queryOrgId)) {\n      organizationId = queryOrgId\n    }\n  }\n\n  let actorUserId: string | undefined = canViewTenant ? undefined : auth.sub\n  let actorUserIds: string[] | undefined\n  if (canViewTenant && actorQuery) {\n    const parsedActorUserIds = splitCsv(actorQuery)\n    if (parsedActorUserIds.length === 1) {\n      actorUserId = parsedActorUserIds[0]\n    } else if (parsedActorUserIds.length > 1) {\n      actorUserId = undefined\n      actorUserIds = parsedActorUserIds\n    }\n  }\n\n  let entriesResult: Awaited<ReturnType<ActionLogService['list']>>\n  try {\n    entriesResult = await actionLogs.list({\n      tenantId: auth.tenantId ?? undefined,\n      organizationId: organizationId ?? undefined,\n      actorUserId,\n      actorUserIds,\n      resourceKind,\n      resourceId,\n      actionTypes,\n      fieldNames,\n      includeRelated,\n      undoableOnly,\n      sortField,\n      sortDir,\n      limit,\n      before,\n      after,\n    })\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })\n    }\n    throw err\n  }\n  const entries = entriesResult.items\n\n  const displayMaps = await loadAuditLogDisplayMaps(em, {\n    userIds: entries.map((entry: any) => entry.actorUserId).filter((value: any): value is string => Boolean(value)),\n    tenantIds: entries.map((entry: any) => entry.tenantId).filter((value: any): value is string => Boolean(value)),\n    organizationIds: entries.map((entry: any) => entry.organizationId).filter((value: any): value is string => Boolean(value)),\n  })\n\n  const rows = entries.flatMap((entry: any) => {\n    const actionType = deriveActionLogActionType(entry)\n    const actionLabel = actionType === 'system'\n      ? entry.actionLabel ?? 'System'\n      : actionType.charAt(0).toUpperCase() + actionType.slice(1)\n    const baseRow = {\n      when: entry.createdAt?.toISOString?.() ?? '',\n      user: entry.actorUserId ? displayMaps.users[entry.actorUserId] ?? entry.actorUserId : 'System',\n      action: actionLabel,\n      source: deriveActionLogSource(entry.contextJson, entry.actorUserId).toUpperCase(),\n    }\n    const changes = extractChangeRows(entry.changesJson, entry.snapshotBefore)\n\n    if (changes.length === 0) {\n      return [{\n        ...baseRow,\n        field: '',\n        oldValue: '',\n        newValue: '',\n      }]\n    }\n\n    return changes.map((change) => {\n      return {\n        ...baseRow,\n        field: change.field,\n        oldValue: formatValue(change.from),\n        newValue: formatValue(change.to),\n      }\n    })\n  })\n\n  const prepared: PreparedExport = {\n    columns: [\n      { field: 'when', header: 'When' },\n      { field: 'user', header: 'User' },\n      { field: 'action', header: 'Action' },\n      { field: 'field', header: 'Field' },\n      { field: 'oldValue', header: 'Old Value' },\n      { field: 'newValue', header: 'New Value' },\n      { field: 'source', header: 'Source' },\n    ],\n    rows,\n  }\n\n  const serialized = serializeExport(prepared, 'csv')\n  const filename = defaultExportFilename('changelog-export', 'csv')\n\n  return new Response(serialized.body, {\n    headers: {\n      'content-type': serialized.contentType,\n      'content-disposition': `attachment; filename=\"${filename}\"`,\n    },\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Export action audit logs',\n  description: 'Exports filtered action audit log entries for the current tenant as CSV.',\n  methods: {\n    GET: {\n      summary: 'Export action logs as CSV',\n      description:\n        'Returns a CSV attachment containing filtered action audit log entries. Tenant administrators can widen the scope to other actors or organizations.',\n      query: exportQuerySchema,\n      responses: [\n        { status: 200, description: 'CSV export generated successfully', schema: responseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid filter values', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB,uBAA4C;AAE5E,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAE3C,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,+BAA+B;AAEjC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,MAAM,qBAAqB;AAC3B,MAAM,cAAc,CAAC,aAAa,QAAQ,UAAU,SAAS,QAAQ;AACrE,MAAM,kBAAkB,CAAC,OAAO,MAAM;AAEtC,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0CAA0C,EAAE,SAAS;AAAA,EAChG,aAAa,EACV,OAAO,EACP,SAAS,+HAA+H,EACxI,SAAS;AAAA,EACZ,cAAc,EAAE,OAAO,EAAE,SAAS,oDAAoD,EAAE,SAAS;AAAA,EACjG,YAAY,EAAE,OAAO,EAAE,SAAS,qDAAqD,EAAE,SAAS;AAAA,EAChG,YAAY,EACT,OAAO,EACP,SAAS,iHAAiH,EAC1H,SAAS;AAAA,EACZ,WAAW,EACR,OAAO,EACP,SAAS,yGAAyG,EAClH,SAAS;AAAA,EACZ,gBAAgB,EACb,KAAK,CAAC,QAAQ,OAAO,CAAC,EACtB,QAAQ,OAAO,EACf,SAAS,oGAAoG,EAC7G,SAAS;AAAA,EACZ,cAAc,EACX,KAAK,CAAC,QAAQ,OAAO,CAAC,EACtB,QAAQ,OAAO,EACf,SAAS,iDAAiD,EAC1D,SAAS;AAAA,EACZ,OAAO,EAAE,OAAO,EAAE,SAAS,oEAAoE,EAAE,SAAS;AAAA,EAC1G,WAAW,EACR,KAAK,WAAW,EAChB,SAAS,kEAAkE,EAC3E,SAAS;AAAA,EACZ,SAAS,EACN,KAAK,eAAe,EACpB,SAAS,kCAAkC,EAC3C,SAAS;AAAA,EACZ,QAAQ,EAAE,OAAO,EAAE,SAAS,uDAAuD,EAAE,SAAS;AAAA,EAC9F,OAAO,EAAE,OAAO,EAAE,SAAS,sDAAsD,EAAE,SAAS;AAC9F,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,QAAQ,KAAK;AACvB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,SAAS,SAAS,OAAgC;AAChD,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,SAAS,iBAAiB,OAAsB;AAC9C,SAAO,SAAS,KAAK,EAAE;AAAA,IAAO,CAAC,UAC7B,mBAAmB,SAAS,KAA4C;AAAA,EAC1E;AACF;AAEA,SAAS,WAAW,OAA8B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,SAAO,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,KAAK,GAAG,CAAC,GAAG,GAAI;AACtD;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,KAAK,MAAM,KAAK;AAClC,MAAI,OAAO,MAAM,SAAS,EAAG,QAAO;AACpC,SAAO,IAAI,KAAK,SAAS;AAC3B;AAEA,SAAS,YAAY,OAAwB;AAC3C,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,UAAU,YAAY,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACnG,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,SAAO,OAAO,KAAK;AACrB;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,gBAAgB,uBAAuB,MAAM,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAC3H,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,aAAa,UAAU,QAAQ,kBAAkB;AACvD,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,gBAAgB,MAAM,KAAK;AAAA,IAC/B,KAAK;AAAA,IACL,CAAC,wBAAwB;AAAA,IACzB,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,yBAAyB,KAAK;AAAA,EACnF;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,aAAa,IAAI,aAAa,IAAI,gBAAgB;AACxD,QAAM,aAAa,IAAI,aAAa,IAAI,aAAa;AACrD,QAAM,eAAe,IAAI,aAAa,IAAI,cAAc,KAAK;AAC7D,QAAM,aAAa,IAAI,aAAa,IAAI,YAAY,KAAK;AACzD,QAAM,cAAc,iBAAiB,IAAI,aAAa,IAAI,YAAY,CAAC;AACvE,QAAM,aAAa,SAAS,IAAI,aAAa,IAAI,WAAW,CAAC;AAC7D,QAAM,iBAAiB,kBAAkB,IAAI,aAAa,IAAI,gBAAgB,CAAC,MAAM;AACrF,QAAM,eAAe,kBAAkB,IAAI,aAAa,IAAI,cAAc,CAAC,MAAM;AACjF,QAAM,QAAQ,WAAW,IAAI,aAAa,IAAI,OAAO,CAAC;AACtD,QAAM,YAAY,YAAY,KAAK,CAAC,UAAU,UAAU,IAAI,aAAa,IAAI,WAAW,CAAC,KAAK;AAC9F,QAAM,UAAU,gBAAgB,KAAK,CAAC,UAAU,UAAU,IAAI,aAAa,IAAI,SAAS,CAAC,KAAK;AAC9F,QAAM,SAAS,UAAU,IAAI,aAAa,IAAI,QAAQ,CAAC;AACvD,QAAM,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,CAAC;AAErD,MAAI,iBAAiB;AACrB,MAAI,YAAY;AACd,QAAI,MAAM,eAAe,QAAQ,MAAM,WAAW,SAAS,UAAU,GAAG;AACtE,uBAAiB;AAAA,IACnB;AAAA,EACF;AAEA,MAAI,cAAkC,gBAAgB,SAAY,KAAK;AACvE,MAAI;AACJ,MAAI,iBAAiB,YAAY;AAC/B,UAAM,qBAAqB,SAAS,UAAU;AAC9C,QAAI,mBAAmB,WAAW,GAAG;AACnC,oBAAc,mBAAmB,CAAC;AAAA,IACpC,WAAW,mBAAmB,SAAS,GAAG;AACxC,oBAAc;AACd,qBAAe;AAAA,IACjB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,KAAK;AAAA,MACpC,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,kBAAkB;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/F;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAU,cAAc;AAE9B,QAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,IACpD,SAAS,QAAQ,IAAI,CAAC,UAAe,MAAM,WAAW,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,IAC9G,WAAW,QAAQ,IAAI,CAAC,UAAe,MAAM,QAAQ,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,IAC7G,iBAAiB,QAAQ,IAAI,CAAC,UAAe,MAAM,cAAc,EAAE,OAAO,CAAC,UAAgC,QAAQ,KAAK,CAAC;AAAA,EAC3H,CAAC;AAED,QAAM,OAAO,QAAQ,QAAQ,CAAC,UAAe;AAC3C,UAAM,aAAa,0BAA0B,KAAK;AAClD,UAAM,cAAc,eAAe,WAC/B,MAAM,eAAe,WACrB,WAAW,OAAO,CAAC,EAAE,YAAY,IAAI,WAAW,MAAM,CAAC;AAC3D,UAAM,UAAU;AAAA,MACd,MAAM,MAAM,WAAW,cAAc,KAAK;AAAA,MAC1C,MAAM,MAAM,cAAc,YAAY,MAAM,MAAM,WAAW,KAAK,MAAM,cAAc;AAAA,MACtF,QAAQ;AAAA,MACR,QAAQ,sBAAsB,MAAM,aAAa,MAAM,WAAW,EAAE,YAAY;AAAA,IAClF;AACA,UAAM,UAAU,kBAAkB,MAAM,aAAa,MAAM,cAAc;AAEzE,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,CAAC;AAAA,QACN,GAAG;AAAA,QACH,OAAO;AAAA,QACP,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAEA,WAAO,QAAQ,IAAI,CAAC,WAAW;AAC7B,aAAO;AAAA,QACL,GAAG;AAAA,QACH,OAAO,OAAO;AAAA,QACd,UAAU,YAAY,OAAO,IAAI;AAAA,QACjC,UAAU,YAAY,OAAO,EAAE;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AAED,QAAM,WAA2B;AAAA,IAC/B,SAAS;AAAA,MACP,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAAA,MAChC,EAAE,OAAO,QAAQ,QAAQ,OAAO;AAAA,MAChC,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,MACpC,EAAE,OAAO,SAAS,QAAQ,QAAQ;AAAA,MAClC,EAAE,OAAO,YAAY,QAAQ,YAAY;AAAA,MACzC,EAAE,OAAO,YAAY,QAAQ,YAAY;AAAA,MACzC,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,IACtC;AAAA,IACA;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,UAAU,KAAK;AAClD,QAAM,WAAW,sBAAsB,oBAAoB,KAAK;AAEhE,SAAO,IAAI,SAAS,WAAW,MAAM;AAAA,IACnC,SAAS;AAAA,MACP,gBAAgB,WAAW;AAAA,MAC3B,uBAAuB,yBAAyB,QAAQ;AAAA,IAC1D;AAAA,EACF,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,eAAe;AAAA,MAC1F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/audit_logs/api/audit-logs/actions/route.js

@@ -3,7 +3,6 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { loadAuditLogDisplayMaps } from "../display.js";
-import { requireResolvedTenantScope } from "../readScope.js";
 import { z } from "zod";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { ACTION_LOG_FILTER_TYPES } from "@open-mercato/core/modules/audit_logs/lib/projections";
@@ -104,8 +103,6 @@ function parseNumber(param, { min, max, fallback }) {
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const tenantScopeGuard = requireResolvedTenantScope(auth);
-  if (tenantScopeGuard) return tenantScopeGuard;
   const container = await createRequestContainer();
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req });
   const rbac = container.resolve("rbacService");
@@ -231,8 +228,7 @@ const openApi = {
       ],
       errors: [
         { status: 400, description: "Invalid filter values", schema: errorSchema },
-        { status: 401, description: "Authentication required", schema: errorSchema },
-        { status: 403, description: "Caller has no resolved tenant scope and is not a superadmin", schema: errorSchema }
+        { status: 401, description: "Authentication required", schema: errorSchema }
       ]
     }
   }