@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/dashboards/widgets/dashboard/top-products/widget.client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dashboards/widgets/dashboard/top-products/widget.client.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { DashboardWidgetComponentProps } from '@open-mercato/shared/modules/dashboard/widgets'\nimport { useWidgetData, type WidgetDataFetcher } from '@open-mercato/ui/backend/dashboard/widgetData'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { BarChart, type BarChartDataItem } from '@open-mercato/ui/backend/charts'\nimport { DateRangeSelect, InlineDateRangeSelect, type DateRangePreset } from '@open-mercato/ui/backend/date-range'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { DEFAULT_SETTINGS, hydrateSettings, type TopProductsSettings } from './config'\nimport type { WidgetDataResponse } from '../../../services/widgetDataService'\nimport { formatCurrencyCompact } from '../../../lib/formatters'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dashboards').child({ component: 'top-products' })\n\nasync function fetchTopProductsData(settings: TopProductsSettings, fetchWidgetData: WidgetDataFetcher): Promise<WidgetDataResponse> {\n  const body = {\n    entityType: 'sales:order_lines',\n    metric: {\n      field: 'totalGrossAmount',\n      aggregate: 'sum',\n    },\n    groupBy: {\n      field: 'productId',\n      limit: settings.limit,\n      resolveLabels: true,\n    },\n    dateRange: {\n      field: 'createdAt',\n      preset: settings.dateRange,\n    },\n  }\n\n  return fetchWidgetData<WidgetDataResponse>(body)\n}\n\nfunction truncateLabel(\n  label: unknown,\n  t: (key: string, fallback: string) => string,\n  maxLength: number = 20\n): string {\n  if (label == null || label === '') return t('dashboards.analytics.labels.unknownProduct', 'Unknown Product')\n  const labelStr = String(label)\n  // Check for UUID-like strings or meaningless values\n  if (labelStr === '0' || labelStr === 'null' || labelStr === 'undefined') {\n    return t('dashboards.analytics.labels.unknownProduct', 'Unknown Product')\n  }\n  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(labelStr)) {\n    return t('dashboards.analytics.labels.unnamedProduct', 'Unnamed Product')\n  }\n  if (labelStr.length <= maxLength) return labelStr\n  return labelStr.slice(0, maxLength - 3) + '...'\n}\n\nconst TopProductsWidget: React.FC<DashboardWidgetComponentProps<TopProductsSettings>> = ({\n  mode,\n  settings = DEFAULT_SETTINGS,\n  onSettingsChange,\n  refreshToken,\n  onRefreshStateChange,\n}) => {\n  const t = useT()\n  const hydrated = React.useMemo(() => hydrateSettings(settings), [settings])\n  const [data, setData] = React.useState<BarChartDataItem[]>([])\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const fetchingRef = React.useRef(false)\n\n  const fetchWidgetData = useWidgetData()\n  const refresh = React.useCallback(async () => {\n    if (fetchingRef.current) return\n    fetchingRef.current = true\n    onRefreshStateChange?.(true)\n    setLoading(true)\n    setError(null)\n    try {\n      const result = await fetchTopProductsData(hydrated, fetchWidgetData)\n      const chartData = result.data.map((item, index) => ({\n        name: truncateLabel(item.groupLabel ?? item.groupKey ?? `Product ${index + 1}`, t),\n        Revenue: item.value ?? 0,\n      }))\n      setData(chartData)\n    } catch (err) {\n      logger.error('Failed to load top products data', { err })\n      setError(t('dashboards.analytics.widgets.topProducts.error', 'Failed to load data'))\n    } finally {\n      setLoading(false)\n      onRefreshStateChange?.(false)\n      fetchingRef.current = false\n    }\n  }, [hydrated, fetchWidgetData, onRefreshStateChange, t])\n\n  React.useEffect(() => {\n    refresh().catch(() => {})\n  }, [refresh, refreshToken])\n\n  if (mode === 'settings') {\n    return (\n      <div className=\"space-y-4 text-sm\">\n        <DateRangeSelect\n          id=\"top-products-date-range\"\n          label={t('dashboards.analytics.settings.dateRange', 'Date Range')}\n          value={hydrated.dateRange}\n          onChange={(dateRange: DateRangePreset) => onSettingsChange({ ...hydrated, dateRange })}\n        />\n        <div className=\"space-y-1.5\">\n          <label\n            htmlFor=\"top-products-limit\"\n            className=\"text-xs font-semibold uppercase text-muted-foreground\"\n          >\n            {t('dashboards.analytics.settings.limit', 'Number of items')}\n          </label>\n          <Input\n            id=\"top-products-limit\"\n            type=\"number\"\n            min={1}\n            max={20}\n            className=\"w-24\"\n            value={hydrated.limit}\n            onChange={(e) => {\n              const next = Number(e.target.value)\n              onSettingsChange({ ...hydrated, limit: Number.isFinite(next) ? next : hydrated.limit })\n            }}\n          />\n        </div>\n        <div className=\"space-y-1.5\">\n          <label\n            htmlFor=\"top-products-layout\"\n            className=\"text-xs font-semibold uppercase text-muted-foreground\"\n          >\n            {t('dashboards.analytics.settings.chartLayout', 'Chart Layout')}\n          </label>\n          <Select\n            value={hydrated.layout}\n            onValueChange={(value) => onSettingsChange({ ...hydrated, layout: value as 'horizontal' | 'vertical' })}\n          >\n            <SelectTrigger id=\"top-products-layout\" size=\"sm\">\n              <SelectValue />\n            </SelectTrigger>\n            <SelectContent>\n              <SelectItem value=\"horizontal\">{t('dashboards.analytics.settings.horizontal', 'Horizontal')}</SelectItem>\n              <SelectItem value=\"vertical\">{t('dashboards.analytics.settings.vertical', 'Vertical')}</SelectItem>\n            </SelectContent>\n          </Select>\n        </div>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"flex flex-col h-full\">\n      <div className=\"flex justify-end mb-2\">\n        <InlineDateRangeSelect\n          value={hydrated.dateRange}\n          onChange={(dateRange) => onSettingsChange({ ...hydrated, dateRange })}\n        />\n      </div>\n      <div className=\"flex-1 min-h-0\">\n        <BarChart\n          data={data}\n          index=\"name\"\n          categories={['Revenue']}\n          categoryLabels={{ Revenue: t('dashboards.analytics.widgets.topCustomers.column.revenue', 'Revenue') }}\n          loading={loading}\n          error={error}\n          layout={hydrated.layout}\n          valueFormatter={formatCurrencyCompact}\n          colors={['emerald']}\n          showLegend={false}\n          emptyMessage={t('dashboards.analytics.widgets.topProducts.empty', 'No product sales data for this period')}\n        />\n      </div>\n    </div>\n  )\n}\n\nexport default TopProductsWidget\n"],
-  "mappings": ";AA2GQ,cAMA,YANA;AAzGR,YAAY,WAAW;AAEvB,SAAS,qBAA6C;AACtD,SAAS,YAAY;AACrB,SAAS,gBAAuC;AAChD,SAAS,iBAAiB,6BAAmD;AAC7E,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,uBAAiD;AAE5E,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAE7E,eAAe,qBAAqB,UAA+B,iBAAiE;AAClI,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,QAAQ;AAAA,MACN,OAAO;AAAA,MACP,WAAW;AAAA,IACb;AAAA,IACA,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,SAAS;AAAA,MAChB,eAAe;AAAA,IACjB;AAAA,IACA,WAAW;AAAA,MACT,OAAO;AAAA,MACP,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAEA,SAAO,gBAAoC,IAAI;AACjD;AAEA,SAAS,cACP,OACA,GACA,YAAoB,IACZ;AACR,MAAI,SAAS,QAAQ,UAAU,GAAI,QAAO,EAAE,8CAA8C,iBAAiB;AAC3G,QAAM,WAAW,OAAO,KAAK;AAE7B,MAAI,aAAa,OAAO,aAAa,UAAU,aAAa,aAAa;AACvE,WAAO,EAAE,8CAA8C,iBAAiB;AAAA,EAC1E;AACA,MAAI,kEAAkE,KAAK,QAAQ,GAAG;AACpF,WAAO,EAAE,8CAA8C,iBAAiB;AAAA,EAC1E;AACA,MAAI,SAAS,UAAU,UAAW,QAAO;AACzC,SAAO,SAAS,MAAM,GAAG,YAAY,CAAC,IAAI;AAC5C;AAEA,MAAM,oBAAkF,CAAC;AAAA,EACvF;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AACF,MAAM;AACJ,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,GAAG,CAAC,QAAQ,CAAC;AAC1E,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA6B,CAAC,CAAC;AAC7D,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,cAAc,MAAM,OAAO,KAAK;AAEtC,QAAM,kBAAkB,cAAc;AACtC,QAAM,UAAU,MAAM,YAAY,YAAY;AAC5C,QAAI,YAAY,QAAS;AACzB,gBAAY,UAAU;AACtB,2BAAuB,IAAI;AAC3B,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,qBAAqB,UAAU,eAAe;AACnE,YAAM,YAAY,OAAO,KAAK,IAAI,CAAC,MAAM,WAAW;AAAA,QAClD,MAAM,cAAc,KAAK,cAAc,KAAK,YAAY,WAAW,QAAQ,CAAC,IAAI,CAAC;AAAA,QACjF,SAAS,KAAK,SAAS;AAAA,MACzB,EAAE;AACF,cAAQ,SAAS;AAAA,IACnB,SAAS,KAAK;AACZ,aAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,eAAS,EAAE,kDAAkD,qBAAqB,CAAC;AAAA,IACrF,UAAE;AACA,iBAAW,KAAK;AAChB,6BAAuB,KAAK;AAC5B,kBAAY,UAAU;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,UAAU,iBAAiB,sBAAsB,CAAC,CAAC;AAEvD,QAAM,UAAU,MAAM;AACpB,YAAQ,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1B,GAAG,CAAC,SAAS,YAAY,CAAC;AAE1B,MAAI,SAAS,YAAY;AACvB,WACE,qBAAC,SAAI,WAAU,qBACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,OAAO,EAAE,2CAA2C,YAAY;AAAA,UAChE,OAAO,SAAS;AAAA,UAChB,UAAU,CAAC,cAA+B,iBAAiB,EAAE,GAAG,UAAU,UAAU,CAAC;AAAA;AAAA,MACvF;AAAA,MACA,qBAAC,SAAI,WAAU,eACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,WAAU;AAAA,YAET,YAAE,uCAAuC,iBAAiB;AAAA;AAAA,QAC7D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,WAAU;AAAA,YACV,OAAO,SAAS;AAAA,YAChB,UAAU,CAAC,MAAM;AACf,oBAAM,OAAO,OAAO,EAAE,OAAO,KAAK;AAClC,+BAAiB,EAAE,GAAG,UAAU,OAAO,OAAO,SAAS,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC;AAAA,YACxF;AAAA;AAAA,QACF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,eACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,WAAU;AAAA,YAET,YAAE,6CAA6C,cAAc;AAAA;AAAA,QAChE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,SAAS;AAAA,YAChB,eAAe,CAAC,UAAU,iBAAiB,EAAE,GAAG,UAAU,QAAQ,MAAmC,CAAC;AAAA,YAEtG;AAAA,kCAAC,iBAAc,IAAG,uBAAsB,MAAK,MAC3C,8BAAC,eAAY,GACf;AAAA,cACA,qBAAC,iBACC;AAAA,oCAAC,cAAW,OAAM,cAAc,YAAE,4CAA4C,YAAY,GAAE;AAAA,gBAC5F,oBAAC,cAAW,OAAM,YAAY,YAAE,0CAA0C,UAAU,GAAE;AAAA,iBACxF;AAAA;AAAA;AAAA,QACF;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,wBACb;AAAA,wBAAC,SAAI,WAAU,yBACb;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS;AAAA,QAChB,UAAU,CAAC,cAAc,iBAAiB,EAAE,GAAG,UAAU,UAAU,CAAC;AAAA;AAAA,IACtE,GACF;AAAA,IACA,oBAAC,SAAI,WAAU,kBACb;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,OAAM;AAAA,QACN,YAAY,CAAC,SAAS;AAAA,QACtB,gBAAgB,EAAE,SAAS,EAAE,4DAA4D,SAAS,EAAE;AAAA,QACpG;AAAA,QACA;AAAA,QACA,QAAQ,SAAS;AAAA,QACjB,gBAAgB;AAAA,QAChB,QAAQ,CAAC,SAAS;AAAA,QAClB,YAAY;AAAA,QACZ,cAAc,EAAE,kDAAkD,uCAAuC;AAAA;AAAA,IAC3G,GACF;AAAA,KACF;AAEJ;AAEA,IAAO,wBAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport type { DashboardWidgetComponentProps } from '@open-mercato/shared/modules/dashboard/widgets'\nimport { useWidgetData, type WidgetDataFetcher } from '@open-mercato/ui/backend/dashboard/widgetData'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport { BarChart, type BarChartDataItem } from '@open-mercato/ui/backend/charts'\nimport { DateRangeSelect, InlineDateRangeSelect, type DateRangePreset } from '@open-mercato/ui/backend/date-range'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@open-mercato/ui/primitives/select'\nimport { DEFAULT_SETTINGS, hydrateSettings, type TopProductsSettings } from './config'\nimport type { WidgetDataResponse } from '../../../services/widgetDataService'\nimport { createCurrencyFormatters } from '../../../lib/formatters'\nimport { UnlabelledAmountNotice } from '../../../components/UnlabelledAmountNotice'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dashboards').child({ component: 'top-products' })\n\nasync function fetchTopProductsData(settings: TopProductsSettings, fetchWidgetData: WidgetDataFetcher): Promise<WidgetDataResponse> {\n  const body = {\n    entityType: 'sales:order_lines',\n    metric: {\n      field: 'totalGrossAmount',\n      aggregate: 'sum',\n    },\n    groupBy: {\n      field: 'productId',\n      limit: settings.limit,\n      resolveLabels: true,\n    },\n    dateRange: {\n      field: 'createdAt',\n      preset: settings.dateRange,\n    },\n  }\n\n  return fetchWidgetData<WidgetDataResponse>(body)\n}\n\nfunction truncateLabel(\n  label: unknown,\n  t: (key: string, fallback: string) => string,\n  maxLength: number = 20\n): string {\n  if (label == null || label === '') return t('dashboards.analytics.labels.unknownProduct', 'Unknown Product')\n  const labelStr = String(label)\n  // Check for UUID-like strings or meaningless values\n  if (labelStr === '0' || labelStr === 'null' || labelStr === 'undefined') {\n    return t('dashboards.analytics.labels.unknownProduct', 'Unknown Product')\n  }\n  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(labelStr)) {\n    return t('dashboards.analytics.labels.unnamedProduct', 'Unnamed Product')\n  }\n  if (labelStr.length <= maxLength) return labelStr\n  return labelStr.slice(0, maxLength - 3) + '...'\n}\n\nconst TopProductsWidget: React.FC<DashboardWidgetComponentProps<TopProductsSettings>> = ({\n  mode,\n  settings = DEFAULT_SETTINGS,\n  onSettingsChange,\n  refreshToken,\n  onRefreshStateChange,\n}) => {\n  const t = useT()\n  const locale = useLocale()\n  const hydrated = React.useMemo(() => hydrateSettings(settings), [settings])\n  const [data, setData] = React.useState<BarChartDataItem[]>([])\n  const [currency, setCurrency] = React.useState<string | null>(null)\n  const [loading, setLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const fetchingRef = React.useRef(false)\n  const money = React.useMemo(() => createCurrencyFormatters(currency, '--', locale), [currency, locale])\n\n  const fetchWidgetData = useWidgetData()\n  const refresh = React.useCallback(async () => {\n    if (fetchingRef.current) return\n    fetchingRef.current = true\n    onRefreshStateChange?.(true)\n    setLoading(true)\n    setError(null)\n    try {\n      const result = await fetchTopProductsData(hydrated, fetchWidgetData)\n      const chartData = result.data.map((item, index) => ({\n        name: truncateLabel(item.groupLabel ?? item.groupKey ?? `Product ${index + 1}`, t),\n        Revenue: item.value ?? 0,\n      }))\n      setData(chartData)\n      setCurrency(result.metadata?.currency ?? null)\n    } catch (err) {\n      logger.error('Failed to load top products data', { err })\n      setError(t('dashboards.analytics.widgets.topProducts.error', 'Failed to load data'))\n    } finally {\n      setLoading(false)\n      onRefreshStateChange?.(false)\n      fetchingRef.current = false\n    }\n  }, [hydrated, fetchWidgetData, onRefreshStateChange, t])\n\n  React.useEffect(() => {\n    refresh().catch(() => {})\n  }, [refresh, refreshToken])\n\n  if (mode === 'settings') {\n    return (\n      <div className=\"space-y-4 text-sm\">\n        <DateRangeSelect\n          id=\"top-products-date-range\"\n          label={t('dashboards.analytics.settings.dateRange', 'Date Range')}\n          value={hydrated.dateRange}\n          onChange={(dateRange: DateRangePreset) => onSettingsChange({ ...hydrated, dateRange })}\n        />\n        <div className=\"space-y-1.5\">\n          <label\n            htmlFor=\"top-products-limit\"\n            className=\"text-xs font-semibold uppercase text-muted-foreground\"\n          >\n            {t('dashboards.analytics.settings.limit', 'Number of items')}\n          </label>\n          <Input\n            id=\"top-products-limit\"\n            type=\"number\"\n            min={1}\n            max={20}\n            className=\"w-24\"\n            value={hydrated.limit}\n            onChange={(e) => {\n              const next = Number(e.target.value)\n              onSettingsChange({ ...hydrated, limit: Number.isFinite(next) ? next : hydrated.limit })\n            }}\n          />\n        </div>\n        <div className=\"space-y-1.5\">\n          <label\n            htmlFor=\"top-products-layout\"\n            className=\"text-xs font-semibold uppercase text-muted-foreground\"\n          >\n            {t('dashboards.analytics.settings.chartLayout', 'Chart Layout')}\n          </label>\n          <Select\n            value={hydrated.layout}\n            onValueChange={(value) => onSettingsChange({ ...hydrated, layout: value as 'horizontal' | 'vertical' })}\n          >\n            <SelectTrigger id=\"top-products-layout\" size=\"sm\">\n              <SelectValue />\n            </SelectTrigger>\n            <SelectContent>\n              <SelectItem value=\"horizontal\">{t('dashboards.analytics.settings.horizontal', 'Horizontal')}</SelectItem>\n              <SelectItem value=\"vertical\">{t('dashboards.analytics.settings.vertical', 'Vertical')}</SelectItem>\n            </SelectContent>\n          </Select>\n        </div>\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"flex flex-col h-full\">\n      <div className=\"flex justify-end mb-2\">\n        <InlineDateRangeSelect\n          value={hydrated.dateRange}\n          onChange={(dateRange) => onSettingsChange({ ...hydrated, dateRange })}\n        />\n      </div>\n      <div className=\"flex-1 min-h-0\">\n        <BarChart\n          data={data}\n          index=\"name\"\n          categories={['Revenue']}\n          categoryLabels={{ Revenue: t('dashboards.analytics.widgets.topCustomers.column.revenue', 'Revenue') }}\n          loading={loading}\n          error={error}\n          layout={hydrated.layout}\n          valueFormatter={money.formatCompact}\n          colors={['emerald']}\n          showLegend={false}\n          emptyMessage={t('dashboards.analytics.widgets.topProducts.empty', 'No product sales data for this period')}\n        />\n      </div>\n      <UnlabelledAmountNotice currency={currency} loading={loading} error={error} />\n    </div>\n  )\n}\n\nexport default TopProductsWidget\n"],
+  "mappings": ";AAgHQ,cAMA,YANA;AA9GR,YAAY,WAAW;AAEvB,SAAS,qBAA6C;AACtD,SAAS,WAAW,YAAY;AAChC,SAAS,gBAAuC;AAChD,SAAS,iBAAiB,6BAAmD;AAC7E,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,uBAAiD;AAE5E,SAAS,gCAAgC;AACzC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAE7E,eAAe,qBAAqB,UAA+B,iBAAiE;AAClI,QAAM,OAAO;AAAA,IACX,YAAY;AAAA,IACZ,QAAQ;AAAA,MACN,OAAO;AAAA,MACP,WAAW;AAAA,IACb;AAAA,IACA,SAAS;AAAA,MACP,OAAO;AAAA,MACP,OAAO,SAAS;AAAA,MAChB,eAAe;AAAA,IACjB;AAAA,IACA,WAAW;AAAA,MACT,OAAO;AAAA,MACP,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAEA,SAAO,gBAAoC,IAAI;AACjD;AAEA,SAAS,cACP,OACA,GACA,YAAoB,IACZ;AACR,MAAI,SAAS,QAAQ,UAAU,GAAI,QAAO,EAAE,8CAA8C,iBAAiB;AAC3G,QAAM,WAAW,OAAO,KAAK;AAE7B,MAAI,aAAa,OAAO,aAAa,UAAU,aAAa,aAAa;AACvE,WAAO,EAAE,8CAA8C,iBAAiB;AAAA,EAC1E;AACA,MAAI,kEAAkE,KAAK,QAAQ,GAAG;AACpF,WAAO,EAAE,8CAA8C,iBAAiB;AAAA,EAC1E;AACA,MAAI,SAAS,UAAU,UAAW,QAAO;AACzC,SAAO,SAAS,MAAM,GAAG,YAAY,CAAC,IAAI;AAC5C;AAEA,MAAM,oBAAkF,CAAC;AAAA,EACvF;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AAAA,EACA;AACF,MAAM;AACJ,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,GAAG,CAAC,QAAQ,CAAC;AAC1E,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA6B,CAAC,CAAC;AAC7D,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAwB,IAAI;AAClE,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,cAAc,MAAM,OAAO,KAAK;AACtC,QAAM,QAAQ,MAAM,QAAQ,MAAM,yBAAyB,UAAU,MAAM,MAAM,GAAG,CAAC,UAAU,MAAM,CAAC;AAEtG,QAAM,kBAAkB,cAAc;AACtC,QAAM,UAAU,MAAM,YAAY,YAAY;AAC5C,QAAI,YAAY,QAAS;AACzB,gBAAY,UAAU;AACtB,2BAAuB,IAAI;AAC3B,eAAW,IAAI;AACf,aAAS,IAAI;AACb,QAAI;AACF,YAAM,SAAS,MAAM,qBAAqB,UAAU,eAAe;AACnE,YAAM,YAAY,OAAO,KAAK,IAAI,CAAC,MAAM,WAAW;AAAA,QAClD,MAAM,cAAc,KAAK,cAAc,KAAK,YAAY,WAAW,QAAQ,CAAC,IAAI,CAAC;AAAA,QACjF,SAAS,KAAK,SAAS;AAAA,MACzB,EAAE;AACF,cAAQ,SAAS;AACjB,kBAAY,OAAO,UAAU,YAAY,IAAI;AAAA,IAC/C,SAAS,KAAK;AACZ,aAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,eAAS,EAAE,kDAAkD,qBAAqB,CAAC;AAAA,IACrF,UAAE;AACA,iBAAW,KAAK;AAChB,6BAAuB,KAAK;AAC5B,kBAAY,UAAU;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,UAAU,iBAAiB,sBAAsB,CAAC,CAAC;AAEvD,QAAM,UAAU,MAAM;AACpB,YAAQ,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1B,GAAG,CAAC,SAAS,YAAY,CAAC;AAE1B,MAAI,SAAS,YAAY;AACvB,WACE,qBAAC,SAAI,WAAU,qBACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,OAAO,EAAE,2CAA2C,YAAY;AAAA,UAChE,OAAO,SAAS;AAAA,UAChB,UAAU,CAAC,cAA+B,iBAAiB,EAAE,GAAG,UAAU,UAAU,CAAC;AAAA;AAAA,MACvF;AAAA,MACA,qBAAC,SAAI,WAAU,eACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,WAAU;AAAA,YAET,YAAE,uCAAuC,iBAAiB;AAAA;AAAA,QAC7D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,IAAG;AAAA,YACH,MAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AAAA,YACL,WAAU;AAAA,YACV,OAAO,SAAS;AAAA,YAChB,UAAU,CAAC,MAAM;AACf,oBAAM,OAAO,OAAO,EAAE,OAAO,KAAK;AAClC,+BAAiB,EAAE,GAAG,UAAU,OAAO,OAAO,SAAS,IAAI,IAAI,OAAO,SAAS,MAAM,CAAC;AAAA,YACxF;AAAA;AAAA,QACF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,eACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,WAAU;AAAA,YAET,YAAE,6CAA6C,cAAc;AAAA;AAAA,QAChE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,SAAS;AAAA,YAChB,eAAe,CAAC,UAAU,iBAAiB,EAAE,GAAG,UAAU,QAAQ,MAAmC,CAAC;AAAA,YAEtG;AAAA,kCAAC,iBAAc,IAAG,uBAAsB,MAAK,MAC3C,8BAAC,eAAY,GACf;AAAA,cACA,qBAAC,iBACC;AAAA,oCAAC,cAAW,OAAM,cAAc,YAAE,4CAA4C,YAAY,GAAE;AAAA,gBAC5F,oBAAC,cAAW,OAAM,YAAY,YAAE,0CAA0C,UAAU,GAAE;AAAA,iBACxF;AAAA;AAAA;AAAA,QACF;AAAA,SACF;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,wBACb;AAAA,wBAAC,SAAI,WAAU,yBACb;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS;AAAA,QAChB,UAAU,CAAC,cAAc,iBAAiB,EAAE,GAAG,UAAU,UAAU,CAAC;AAAA;AAAA,IACtE,GACF;AAAA,IACA,oBAAC,SAAI,WAAU,kBACb;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,OAAM;AAAA,QACN,YAAY,CAAC,SAAS;AAAA,QACtB,gBAAgB,EAAE,SAAS,EAAE,4DAA4D,SAAS,EAAE;AAAA,QACpG;AAAA,QACA;AAAA,QACA,QAAQ,SAAS;AAAA,QACjB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,CAAC,SAAS;AAAA,QAClB,YAAY;AAAA,QACZ,cAAc,EAAE,kDAAkD,uCAAuC;AAAA;AAAA,IAC3G,GACF;AAAA,IACA,oBAAC,0BAAuB,UAAoB,SAAkB,OAAc;AAAA,KAC9E;AAEJ;AAEA,IAAO,wBAAQ;",
   "names": []
 }

package/dist/modules/data_sync/api/mappings/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { SyncMapping } from "@open-mercato/core/modules/data_sync/data/entities";
@@ -27,22 +28,26 @@ async function resolveParams(ctx) {
 }
 async function GET(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const parsedParams = await resolveParams(ctx);
   if (!parsedParams.success) {
     return NextResponse.json({ error: "Invalid mapping id" }, { status: 400 });
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     },
     void 0,
@@ -62,9 +67,13 @@ async function GET(req, ctx) {
 }
 async function PUT(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const parsedParams = await resolveParams(ctx);
   if (!parsedParams.success) {
     return NextResponse.json({ error: "Invalid mapping id" }, { status: 400 });
@@ -76,13 +85,13 @@ async function PUT(req, ctx) {
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     },
     void 0,
@@ -130,22 +139,26 @@ async function PUT(req, ctx) {
 }
 async function DELETE(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const parsedParams = await resolveParams(ctx);
   if (!parsedParams.success) {
     return NextResponse.json({ error: "Invalid mapping id" }, { status: 400 });
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const mapping = await findOneWithDecryption(
     em,
     SyncMapping,
     {
       id: parsedParams.data.id,
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     },
     void 0,

package/dist/modules/data_sync/api/mappings/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/mappings/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst idParamsSchema = z.object({ id: z.string().uuid() })\n\nconst updateMappingSchema = z.object({\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  PUT: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  DELETE: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get, update, or delete a field mapping',\n}\n\nasync function resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n  return idParamsSchema.safeParse(rawParams)\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  return NextResponse.json({\n    id: mapping.id,\n    integrationId: mapping.integrationId,\n    entityType: mapping.entityType,\n    mapping: mapping.mapping,\n    createdAt: mapping.createdAt.toISOString(),\n    updatedAt: mapping.updatedAt.toISOString(),\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateMappingSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: mapping.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  mapping.mapping = parsedBody.data.mapping\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: mapping.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: mapping.id,\n    integrationId: mapping.integrationId,\n    entityType: mapping.entityType,\n    mapping: mapping.mapping,\n    updatedAt: mapping.updatedAt.toISOString(),\n  })\n}\n\nexport async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: mapping.id,\n    operation: 'delete',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: null,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const mappingId = mapping.id\n  em.remove(mapping)\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: mappingId,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ deleted: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEzD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAe,cAAc,KAA8D;AACzF,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AACT,SAAO,eAAe,UAAU,SAAS;AAC3C;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ,UAAU,YAAY;AAAA,IACzC,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,oBAAoB,UAAU,OAAO;AACxD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,WAAW;AAAA,EAC9B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,UAAQ,UAAU,WAAW,KAAK;AAClC,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C,CAAC;AACH;AAEA,eAAsB,OAAO,KAAc,KAA8D;AACvG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,QAAQ;AAC1B,KAAG,OAAO,OAAO;AACjB,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAC5C;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst idParamsSchema = z.object({ id: z.string().uuid() })\n\nconst updateMappingSchema = z.object({\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  PUT: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  DELETE: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get, update, or delete a field mapping',\n}\n\nasync function resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n  return idParamsSchema.safeParse(rawParams)\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  return NextResponse.json({\n    id: mapping.id,\n    integrationId: mapping.integrationId,\n    entityType: mapping.entityType,\n    mapping: mapping.mapping,\n    createdAt: mapping.createdAt.toISOString(),\n    updatedAt: mapping.updatedAt.toISOString(),\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = updateMappingSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: mapping.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  mapping.mapping = parsedBody.data.mapping\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: mapping.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: mapping.id,\n    integrationId: mapping.integrationId,\n    entityType: mapping.entityType,\n    mapping: mapping.mapping,\n    updatedAt: mapping.updatedAt.toISOString(),\n  })\n}\n\nexport async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const parsedParams = await resolveParams(ctx)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid mapping id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      id: parsedParams.data.id,\n      organizationId,\n      tenantId: auth.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  if (!mapping) {\n    return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: mapping.id,\n    operation: 'delete',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: null,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const mappingId = mapping.id\n  em.remove(mapping)\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: mappingId,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ deleted: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAEvC,SAAS,6BAA6B;AACtC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEzD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAe,cAAc,KAA8D;AACzF,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AACT,SAAO,eAAe,UAAU,SAAS;AAC3C;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ,UAAU,YAAY;AAAA,IACzC,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,oBAAoB,UAAU,OAAO;AACxD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,WAAW;AAAA,EAC9B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,UAAQ,UAAU,WAAW,KAAK;AAClC,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ,UAAU,YAAY;AAAA,EAC3C,CAAC;AACH;AAEA,eAAsB,OAAO,KAAc,KAA8D;AACvG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,eAAe,MAAM,cAAc,GAAG;AAC5C,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,YAAY,QAAQ;AAC1B,KAAG,OAAO,OAAO;AACjB,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAC5C;",
   "names": []
 }

package/dist/modules/data_sync/api/mappings/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { findAndCountWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { SyncMapping } from "@open-mercato/core/modules/data_sync/data/entities";
@@ -29,9 +30,13 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const url = new URL(req.url);
   const parsed = listMappingsQuerySchema.safeParse({
     integrationId: url.searchParams.get("integrationId") ?? void 0,
@@ -44,7 +49,7 @@ async function GET(req) {
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const where = {
     organizationId: scope.organizationId,
     tenantId: scope.tenantId
@@ -79,9 +84,13 @@ async function GET(req) {
 }
 async function POST(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const payload = await req.json().catch(() => null);
   const parsed = createMappingSchema.safeParse(payload);
   if (!parsed.success) {
@@ -89,7 +98,7 @@ async function POST(req) {
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const existing = await findOneWithDecryption(
     em,
     SyncMapping,

package/dist/modules/data_sync/api/mappings/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/data_sync/api/mappings/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst listMappingsQuerySchema = z.object({\n  integrationId: z.string().min(1).optional(),\n  entityType: z.string().min(1).optional(),\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n})\n\nconst createMappingSchema = z.object({\n  integrationId: z.string().min(1),\n  entityType: z.string().min(1),\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create field mappings',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listMappingsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const where: FilterQuery<SyncMapping> = {\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  }\n  if (parsed.data.integrationId) where.integrationId = parsed.data.integrationId\n  if (parsed.data.entityType) where.entityType = parsed.data.entityType\n\n  const [items, total] = await findAndCountWithDecryption(\n    em,\n    SyncMapping,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: parsed.data.pageSize,\n      offset: (parsed.data.page - 1) * parsed.data.pageSize,\n    },\n    scope,\n  )\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      mapping: item.mapping,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsed = createMappingSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const existing = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      integrationId: parsed.data.integrationId,\n      entityType: parsed.data.entityType,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: existing?.id ?? scope.organizationId,\n    operation: existing ? 'update' : 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  if (existing) {\n    existing.mapping = parsed.data.mapping\n    await em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.mapping',\n        resourceId: existing.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: existing.id,\n      integrationId: existing.integrationId,\n      entityType: existing.entityType,\n      mapping: existing.mapping,\n    })\n  }\n\n  const created = em.create(SyncMapping, {\n    integrationId: parsed.data.integrationId,\n    entityType: parsed.data.entityType,\n    mapping: parsed.data.mapping,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  await em.persist(created).flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: created.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: created.id,\n    integrationId: created.integrationId,\n    entityType: created.entityType,\n    mapping: created.mapping,\n  }, { status: 201 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,6BAA6B;AAClE,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC9D,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,QAAkC;AAAA,IACtC,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,cAAe,OAAM,gBAAgB,OAAO,KAAK;AACjE,MAAI,OAAO,KAAK,WAAY,OAAM,aAAa,OAAO,KAAK;AAE3D,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,OAAO,KAAK;AAAA,MACnB,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK;AAAA,MACd,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,OAAO,KAAK;AAAA,MAC3B,YAAY,OAAO,KAAK;AAAA,MACxB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,UAAU,MAAM,MAAM;AAAA,IAClC,WAAW,WAAW,WAAW;AAAA,IACjC,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,UAAU;AACZ,aAAS,UAAU,OAAO,KAAK;AAC/B,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,GAAG,OAAO,aAAa;AAAA,IACrC,eAAe,OAAO,KAAK;AAAA,IAC3B,YAAY,OAAO,KAAK;AAAA,IACxB,SAAS,OAAO,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAEhC,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,EACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst listMappingsQuerySchema = z.object({\n  integrationId: z.string().min(1).optional(),\n  entityType: z.string().min(1).optional(),\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n})\n\nconst createMappingSchema = z.object({\n  integrationId: z.string().min(1),\n  entityType: z.string().min(1),\n  mapping: z.record(z.string(), z.unknown()),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create field mappings',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const url = new URL(req.url)\n  const parsed = listMappingsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const where: FilterQuery<SyncMapping> = {\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  }\n  if (parsed.data.integrationId) where.integrationId = parsed.data.integrationId\n  if (parsed.data.entityType) where.entityType = parsed.data.entityType\n\n  const [items, total] = await findAndCountWithDecryption(\n    em,\n    SyncMapping,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: parsed.data.pageSize,\n      offset: (parsed.data.page - 1) * parsed.data.pageSize,\n    },\n    scope,\n  )\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      mapping: item.mapping,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsed = createMappingSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const existing = await findOneWithDecryption(\n    em,\n    SyncMapping,\n    {\n      integrationId: parsed.data.integrationId,\n      entityType: parsed.data.entityType,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    },\n    undefined,\n    scope,\n  )\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.mapping',\n    resourceId: existing?.id ?? scope.organizationId,\n    operation: existing ? 'update' : 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  if (existing) {\n    existing.mapping = parsed.data.mapping\n    await em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.mapping',\n        resourceId: existing.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: existing.id,\n      integrationId: existing.integrationId,\n      entityType: existing.entityType,\n      mapping: existing.mapping,\n    })\n  }\n\n  const created = em.create(SyncMapping, {\n    integrationId: parsed.data.integrationId,\n    entityType: parsed.data.entityType,\n    mapping: parsed.data.mapping,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n  await em.persist(created).flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.mapping',\n      resourceId: created.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({\n    id: created.id,\n    integrationId: created.integrationId,\n    entityType: created.entityType,\n    mapping: created.mapping,\n  }, { status: 201 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,6BAA6B;AAClE,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC9D,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAC3C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAkC;AAAA,IACtC,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB;AACA,MAAI,OAAO,KAAK,cAAe,OAAM,gBAAgB,OAAO,KAAK;AACjE,MAAI,OAAO,KAAK,WAAY,OAAM,aAAa,OAAO,KAAK;AAE3D,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,OAAO,KAAK;AAAA,MACnB,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,KAAK;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK;AAAA,MACd,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,SAAS,oBAAoB,UAAU,OAAO;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,OAAO,KAAK;AAAA,MAC3B,YAAY,OAAO,KAAK;AAAA,MACxB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,UAAU,MAAM,MAAM;AAAA,IAClC,WAAW,WAAW,WAAW;AAAA,IACjC,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,UAAU;AACZ,aAAS,UAAU,OAAO,KAAK;AAC/B,UAAM,GAAG,MAAM;AAEf,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,SAAS;AAAA,MACb,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,GAAG,OAAO,aAAa;AAAA,IACrC,eAAe,OAAO,KAAK;AAAA,IAC3B,YAAY,OAAO,KAAK;AAAA,IACxB,SAAS,OAAO,KAAK;AAAA,IACrB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAEhC,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,QAAQ;AAAA,IACZ,eAAe,QAAQ;AAAA,IACvB,YAAY,QAAQ;AAAA,IACpB,SAAS,QAAQ;AAAA,EACnB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;",
   "names": []
 }

package/dist/modules/data_sync/api/options.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAllIntegrations } from "@open-mercato/shared/modules/integrations/types";
 import { getDataSyncAdapter } from "../lib/adapter-registry.js";
@@ -12,13 +13,17 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const container = await createRequestContainer();
   const credentialsService = container.resolve("integrationCredentialsService");
   const stateService = container.resolve("integrationStateService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const items = await Promise.all(
     getAllIntegrations().filter((integration) => integration.hub === "data_sync" && integration.providerKey).map(async (integration) => {
       const adapter = getDataSyncAdapter(integration.providerKey);

package/dist/modules/data_sync/api/options.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/options.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/run.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
@@ -22,9 +23,13 @@ const openApi = {
 async function POST(req) {
   try {
     const auth = await getAuthFromRequest(req);
-    if (!auth?.tenantId || !auth.orgId) {
+    if (!auth?.tenantId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
+    const organizationId = resolveActiveOrganizationId(auth);
+    if (!organizationId) {
+      return organizationScopeRequiredResponse();
+    }
     const payload = await readJsonSafe(req);
     const parsed = runSyncSchema.safeParse(payload);
     if (!parsed.success) {
@@ -35,7 +40,7 @@ async function POST(req) {
     const progressService = container.resolve("progressService");
     const integrationStateService = container.resolve("integrationStateService");
     const scope = {
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     };
     const integration = getIntegration(parsed.data.integrationId);

package/dist/modules/data_sync/api/run.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/run.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { ProgressService } from '../../progress/lib/progressService'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { SyncRunService } from '../lib/sync-run-service'\nimport { runSyncSchema } from '../data/validators'\nimport { startDataSyncRun } from '../lib/start-run'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('data_sync').child({ component: 'run' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Start a data sync run',\n}\n\nexport async function POST(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId || !auth.orgId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const payload = await readJsonSafe(req)\n    const parsed = runSyncSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n\n    const scope = {\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    }\n\n    const integration = getIntegration(parsed.data.integrationId)\n    if (!integration?.providerKey) {\n      return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n    }\n\n    const adapter = getDataSyncAdapter(integration.providerKey)\n    if (!adapter) {\n      return NextResponse.json({ error: 'No registered sync adapter for provider' }, { status: 404 })\n    }\n    if (adapter.runMode === 'provider') {\n      return NextResponse.json(\n        {\n          error: 'This integration must be started from its provider-specific import flow.',\n          settingsPath: `/backend/integrations/${encodeURIComponent(parsed.data.integrationId)}`,\n        },\n        { status: 422 },\n      )\n    }\n\n    if (!adapter.supportedEntities.includes(parsed.data.entityType)) {\n      return NextResponse.json({ error: 'Unsupported entity type for this integration' }, { status: 422 })\n    }\n\n    const integrationEnabled = await integrationStateService.isEnabled(parsed.data.integrationId, scope)\n    if (!integrationEnabled) {\n      return NextResponse.json({ error: 'Integration is disabled' }, { status: 409 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap(\n      parsed.data.integrationId,\n      parsed.data.entityType,\n      parsed.data.direction,\n      scope,\n    )\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: parsed.data.integrationId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const cursor = parsed.data.fullSync\n      ? null\n      : await syncRunService.resolveCursor(parsed.data.integrationId, parsed.data.entityType, parsed.data.direction, scope)\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: parsed.data.integrationId,\n        entityType: parsed.data.entityType,\n        direction: parsed.data.direction,\n        cursor,\n        triggeredBy: parsed.data.triggeredBy ?? auth.sub,\n        batchSize: parsed.data.batchSize,\n      },\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.run',\n        resourceId: run.id,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting sync run', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start data sync run.' },\n      { status: 500 },\n    )\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAI/B,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE5D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAE3E,UAAM,QAAQ;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAEA,UAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,QAAI,CAAC,aAAa,aAAa;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChG;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,cAAc,yBAAyB,mBAAmB,OAAO,KAAK,aAAa,CAAC;AAAA,QACtF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,kBAAkB,SAAS,OAAO,KAAK,UAAU,GAAG;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AAEA,UAAM,qBAAqB,MAAM,wBAAwB,UAAU,OAAO,KAAK,eAAe,KAAK;AACnG,QAAI,CAAC,oBAAoB;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,UAAU,MAAM,eAAe;AAAA,MACnC,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AACA,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpI;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,OAAO,KAAK,WACvB,OACA,MAAM,eAAe,cAAc,OAAO,KAAK,eAAe,OAAO,KAAK,YAAY,OAAO,KAAK,WAAW,KAAK;AAEtH,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe,OAAO,KAAK;AAAA,QAC3B,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW,OAAO,KAAK;AAAA,QACvB;AAAA,QACA,aAAa,OAAO,KAAK,eAAe,KAAK;AAAA,QAC7C,WAAW,OAAO,KAAK;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClG,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,CAAC;AACpE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,iCAAiC;AAAA,MAC1C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { ProgressService } from '../../progress/lib/progressService'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport type { SyncRunService } from '../lib/sync-run-service'\nimport { runSyncSchema } from '../data/validators'\nimport { startDataSyncRun } from '../lib/start-run'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('data_sync').child({ component: 'run' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Start a data sync run',\n}\n\nexport async function POST(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const organizationId = resolveActiveOrganizationId(auth)\n    if (!organizationId) {\n      return organizationScopeRequiredResponse()\n    }\n\n    const payload = await readJsonSafe(req)\n    const parsed = runSyncSchema.safeParse(payload)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n\n    const scope = {\n      organizationId,\n      tenantId: auth.tenantId,\n    }\n\n    const integration = getIntegration(parsed.data.integrationId)\n    if (!integration?.providerKey) {\n      return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n    }\n\n    const adapter = getDataSyncAdapter(integration.providerKey)\n    if (!adapter) {\n      return NextResponse.json({ error: 'No registered sync adapter for provider' }, { status: 404 })\n    }\n    if (adapter.runMode === 'provider') {\n      return NextResponse.json(\n        {\n          error: 'This integration must be started from its provider-specific import flow.',\n          settingsPath: `/backend/integrations/${encodeURIComponent(parsed.data.integrationId)}`,\n        },\n        { status: 422 },\n      )\n    }\n\n    if (!adapter.supportedEntities.includes(parsed.data.entityType)) {\n      return NextResponse.json({ error: 'Unsupported entity type for this integration' }, { status: 422 })\n    }\n\n    const integrationEnabled = await integrationStateService.isEnabled(parsed.data.integrationId, scope)\n    if (!integrationEnabled) {\n      return NextResponse.json({ error: 'Integration is disabled' }, { status: 409 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap(\n      parsed.data.integrationId,\n      parsed.data.entityType,\n      parsed.data.direction,\n      scope,\n    )\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: parsed.data.integrationId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const cursor = parsed.data.fullSync\n      ? null\n      : await syncRunService.resolveCursor(parsed.data.integrationId, parsed.data.entityType, parsed.data.direction, scope)\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: parsed.data.integrationId,\n        entityType: parsed.data.entityType,\n        direction: parsed.data.direction,\n        cursor,\n        triggeredBy: parsed.data.triggeredBy ?? auth.sub,\n        batchSize: parsed.data.batchSize,\n      },\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.run',\n        resourceId: run.id,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting sync run', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start data sync run.' },\n      { status: 500 },\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAI/B,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE5D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,iBAAiB,4BAA4B,IAAI;AACvD,QAAI,CAAC,gBAAgB;AACnB,aAAO,kCAAkC;AAAA,IAC3C;AAEA,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,SAAS,cAAc,UAAU,OAAO;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzG;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAE3E,UAAM,QAAQ;AAAA,MACZ;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAEA,UAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,QAAI,CAAC,aAAa,aAAa;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChG;AACA,QAAI,QAAQ,YAAY,YAAY;AAClC,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,UACP,cAAc,yBAAyB,mBAAmB,OAAO,KAAK,aAAa,CAAC;AAAA,QACtF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,kBAAkB,SAAS,OAAO,KAAK,UAAU,GAAG;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AAEA,UAAM,qBAAqB,MAAM,wBAAwB,UAAU,OAAO,KAAK,eAAe,KAAK;AACnG,QAAI,CAAC,oBAAoB;AACvB,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,UAAU,MAAM,eAAe;AAAA,MACnC,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ;AAAA,IACF;AACA,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpI;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,OAAO,KAAK,WACvB,OACA,MAAM,eAAe,cAAc,OAAO,KAAK,eAAe,OAAO,KAAK,YAAY,OAAO,KAAK,WAAW,KAAK;AAEtH,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe,OAAO,KAAK;AAAA,QAC3B,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW,OAAO,KAAK;AAAA,QACvB;AAAA,QACA,aAAa,OAAO,KAAK,eAAe,KAAK;AAAA,QAC7C,WAAW,OAAO,KAAK;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClG,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,qCAAqC,EAAE,SAAS,MAAM,CAAC;AACpE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,iCAAiC;AAAA,MAC1C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/cancel.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import {
   runCrudMutationGuardAfterSuccess,
@@ -16,9 +17,13 @@ const openApi = {
 };
 async function POST(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsed = paramsSchema.safeParse(rawParams);
   if (!parsed.success) {
@@ -29,7 +34,7 @@ async function POST(req, ctx) {
   const progressService = container.resolve("progressService");
   const integrationLogService = container.resolve("integrationLogService");
   const integrationStateService = container.resolve("integrationStateService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const run = await syncRunService.getRun(parsed.data.id, scope);
   if (!run) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });
@@ -53,7 +58,7 @@ async function POST(req, ctx) {
   }
   const progressCtx = {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     userId: auth.sub
   };
   if (run.progressJobId) {

package/dist/modules/data_sync/api/runs/[id]/cancel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/cancel.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { IntegrationStateService } from '../../../../integrations/lib/state-service'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Cancel a running sync',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService\n  const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (run.status !== 'running' && run.status !== 'pending') {\n    return NextResponse.json({ error: 'Only pending or running runs can be cancelled' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: run.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'cancel' },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const progressCtx = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  }\n\n  if (run.progressJobId) {\n    try {\n      await progressService.markCancelled(run.progressJobId, progressCtx)\n    } catch (error) {\n      const job = await progressService.getJob(run.progressJobId, progressCtx)\n      const cancelRequested = job && (job.status === 'running' || job.status === 'cancelled')\n        ? await progressService.isCancellationRequested(run.progressJobId, progressCtx.tenantId, progressCtx.organizationId)\n        : false\n\n      if (job?.status !== 'cancelled' && !cancelRequested) {\n        throw error\n      }\n    }\n  }\n\n  await syncRunService.markStatus(run.id, 'cancelled', scope)\n  await integrationStateService.upsert(run.integrationId, {\n    lastHealthStatus: 'degraded',\n    lastHealthCheckedAt: new Date(),\n  }, scope)\n  await integrationLogService.write({\n    integrationId: run.integrationId,\n    runId: run.id,\n    level: 'warn',\n    message: 'Sync run cancelled',\n    payload: {\n      operationalStatus: 'cancelled',\n      summary: 'The sync run was cancelled before completion.',\n    },\n  }, scope)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAKvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AACvE,QAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,IAAI,WAAW,aAAa,IAAI,WAAW,WAAW;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,gDAAgD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf;AAEA,MAAI,IAAI,eAAe;AACrB,QAAI;AACF,YAAM,gBAAgB,cAAc,IAAI,eAAe,WAAW;AAAA,IACpE,SAAS,OAAO;AACd,YAAM,MAAM,MAAM,gBAAgB,OAAO,IAAI,eAAe,WAAW;AACvE,YAAM,kBAAkB,QAAQ,IAAI,WAAW,aAAa,IAAI,WAAW,eACvE,MAAM,gBAAgB,wBAAwB,IAAI,eAAe,YAAY,UAAU,YAAY,cAAc,IACjH;AAEJ,UAAI,KAAK,WAAW,eAAe,CAAC,iBAAiB;AACnD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,IAAI,IAAI,aAAa,KAAK;AAC1D,QAAM,wBAAwB,OAAO,IAAI,eAAe;AAAA,IACtD,kBAAkB;AAAA,IAClB,qBAAqB,oBAAI,KAAK;AAAA,EAChC,GAAG,KAAK;AACR,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,IAAI;AAAA,IACnB,OAAO,IAAI;AAAA,IACX,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS;AAAA,MACP,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF,GAAG,KAAK;AAER,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { IntegrationLogService } from '../../../../integrations/lib/log-service'\nimport type { IntegrationStateService } from '../../../../integrations/lib/state-service'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Cancel a running sync',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService\n  const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (run.status !== 'running' && run.status !== 'pending') {\n    return NextResponse.json({ error: 'Only pending or running runs can be cancelled' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: run.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'cancel' },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const progressCtx = {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub,\n  }\n\n  if (run.progressJobId) {\n    try {\n      await progressService.markCancelled(run.progressJobId, progressCtx)\n    } catch (error) {\n      const job = await progressService.getJob(run.progressJobId, progressCtx)\n      const cancelRequested = job && (job.status === 'running' || job.status === 'cancelled')\n        ? await progressService.isCancellationRequested(run.progressJobId, progressCtx.tenantId, progressCtx.organizationId)\n        : false\n\n      if (job?.status !== 'cancelled' && !cancelRequested) {\n        throw error\n      }\n    }\n  }\n\n  await syncRunService.markStatus(run.id, 'cancelled', scope)\n  await integrationStateService.upsert(run.integrationId, {\n    lastHealthStatus: 'degraded',\n    lastHealthCheckedAt: new Date(),\n  }, scope)\n  await integrationLogService.write({\n    integrationId: run.integrationId,\n    runId: run.id,\n    level: 'warn',\n    message: 'Sync run cancelled',\n    payload: {\n      operationalStatus: 'cancelled',\n      summary: 'The sync run was cancelled before completion.',\n    },\n  }, scope)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAKvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AACvE,QAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,IAAI,WAAW,aAAa,IAAI,WAAW,WAAW;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,gDAAgD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc;AAAA,IAClB,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf;AAEA,MAAI,IAAI,eAAe;AACrB,QAAI;AACF,YAAM,gBAAgB,cAAc,IAAI,eAAe,WAAW;AAAA,IACpE,SAAS,OAAO;AACd,YAAM,MAAM,MAAM,gBAAgB,OAAO,IAAI,eAAe,WAAW;AACvE,YAAM,kBAAkB,QAAQ,IAAI,WAAW,aAAa,IAAI,WAAW,eACvE,MAAM,gBAAgB,wBAAwB,IAAI,eAAe,YAAY,UAAU,YAAY,cAAc,IACjH;AAEJ,UAAI,KAAK,WAAW,eAAe,CAAC,iBAAiB;AACnD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,eAAe,WAAW,IAAI,IAAI,aAAa,KAAK;AAC1D,QAAM,wBAAwB,OAAO,IAAI,eAAe;AAAA,IACtD,kBAAkB;AAAA,IAClB,qBAAqB,oBAAI,KAAK;AAAA,EAChC,GAAG,KAAK;AACR,QAAM,sBAAsB,MAAM;AAAA,IAChC,eAAe,IAAI;AAAA,IACnB,OAAO,IAAI;AAAA,IACX,OAAO;AAAA,IACP,SAAS;AAAA,IACT,SAAS;AAAA,MACP,mBAAmB;AAAA,MACnB,SAAS;AAAA,IACX;AAAA,EACF,GAAG,KAAK;AAER,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/retry.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { retrySyncSchema } from "../../../data/validators.js";
@@ -19,9 +20,13 @@ const openApi = {
 };
 async function POST(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -35,7 +40,7 @@ async function POST(req, ctx) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const progressService = container.resolve("progressService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const previous = await syncRunService.getRun(parsedParams.data.id, scope);
   if (!previous) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });