@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/data_sync/api/runs/[id]/retry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/retry.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport { retrySyncSchema } from '../../../data/validators'\nimport { startDataSyncRun } from '../../../lib/start-run'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Retry a failed sync run',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsedBody = retrySyncSchema.safeParse(payload ?? {})\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const previous = await syncRunService.getRun(parsedParams.data.id, scope)\n  if (!previous) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (previous.status !== 'failed' && previous.status !== 'cancelled') {\n    return NextResponse.json({ error: 'Only failed or cancelled runs can be retried' }, { status: 409 })\n  }\n\n  const overlap = await syncRunService.findRunningOverlap(\n    previous.integrationId,\n    previous.entityType,\n    previous.direction,\n    scope,\n  )\n  if (overlap) {\n    return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: previous.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'retry', ...parsedBody.data },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const cursor = parsedBody.data.fromBeginning\n    ? null\n    : previous.cursor ?? await syncRunService.resolveCursor(previous.integrationId, previous.entityType, previous.direction, scope)\n\n  const { run, progressJob } = await startDataSyncRun({\n    syncRunService,\n    progressService,\n    scope: {\n      ...scope,\n      userId: auth.sub,\n    },\n    input: {\n      integrationId: previous.integrationId,\n      entityType: previous.entityType,\n      direction: previous.direction,\n      cursor,\n      triggeredBy: auth.sub,\n      batchSize: 100,\n      progressJob: {\n        name: `Retry data sync ${previous.integrationId} \u2014 ${previous.entityType}`,\n      },\n    },\n  })\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAG7B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,aAAa,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,WAAW,MAAM,eAAe,OAAO,aAAa,KAAK,IAAI,KAAK;AACxE,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,SAAS,WAAW,YAAY,SAAS,WAAW,aAAa;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpI;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS,GAAG,WAAW,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,WAAW,KAAK,gBAC3B,OACA,SAAS,UAAU,MAAM,eAAe,cAAc,SAAS,eAAe,SAAS,YAAY,SAAS,WAAW,KAAK;AAEhI,QAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,IAClD;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,aAAa;AAAA,QACX,MAAM,mBAAmB,SAAS,aAAa,WAAM,SAAS,UAAU;AAAA,MAC1E;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClG;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\nimport { retrySyncSchema } from '../../../data/validators'\nimport { startDataSyncRun } from '../../../lib/start-run'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Retry a failed sync run',\n}\n\nexport async function POST(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsedBody = retrySyncSchema.safeParse(payload ?? {})\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const previous = await syncRunService.getRun(parsedParams.data.id, scope)\n  if (!previous) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n  if (previous.status !== 'failed' && previous.status !== 'cancelled') {\n    return NextResponse.json({ error: 'Only failed or cancelled runs can be retried' }, { status: 409 })\n  }\n\n  const overlap = await syncRunService.findRunningOverlap(\n    previous.integrationId,\n    previous.entityType,\n    previous.direction,\n    scope,\n  )\n  if (overlap) {\n    return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.run',\n    resourceId: previous.id,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { action: 'retry', ...parsedBody.data },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const cursor = parsedBody.data.fromBeginning\n    ? null\n    : previous.cursor ?? await syncRunService.resolveCursor(previous.integrationId, previous.entityType, previous.direction, scope)\n\n  const { run, progressJob } = await startDataSyncRun({\n    syncRunService,\n    progressService,\n    scope: {\n      ...scope,\n      userId: auth.sub,\n    },\n    input: {\n      integrationId: previous.integrationId,\n      entityType: previous.entityType,\n      direction: previous.direction,\n      cursor,\n      triggeredBy: auth.sub,\n      batchSize: 100,\n      progressJob: {\n        name: `Retry data sync ${previous.integrationId} \u2014 ${previous.entityType}`,\n      },\n    },\n  })\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: 'data_sync.run',\n      resourceId: run.id,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAG7B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc,KAA8D;AACrG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,aAAa,gBAAgB,UAAU,WAAW,CAAC,CAAC;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,WAAW,MAAM,eAAe,OAAO,aAAa,KAAK,IAAI,KAAK;AACxE,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AACA,MAAI,SAAS,WAAW,YAAY,SAAS,WAAW,aAAa;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,UAAU,MAAM,eAAe;AAAA,IACnC,SAAS;AAAA,IACT,SAAS;AAAA,IACT,SAAS;AAAA,IACT;AAAA,EACF;AACA,MAAI,SAAS;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,8EAA8E,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpI;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,SAAS,GAAG,WAAW,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,WAAW,KAAK,gBAC3B,OACA,SAAS,UAAU,MAAM,eAAe,cAAc,SAAS,eAAe,SAAS,YAAY,SAAS,WAAW,KAAK;AAEhI,QAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,IAClD;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,IACf;AAAA,IACA,OAAO;AAAA,MACL,eAAe,SAAS;AAAA,MACxB,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,MACX,aAAa;AAAA,QACX,MAAM,mBAAmB,SAAS,aAAa,WAAM,SAAS,UAAU;AAAA,MAC1E;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,IAAI;AAAA,MAChB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,IAAI,IAAI,eAAe,aAAa,MAAM,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAClG;",
   "names": []
 }

package/dist/modules/data_sync/api/runs/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 const paramsSchema = z.object({ id: z.string().uuid() });
 const metadata = {
@@ -12,9 +13,13 @@ const openApi = {
 };
 async function GET(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsed = paramsSchema.safeParse(rawParams);
   if (!parsed.success) {
@@ -23,14 +28,14 @@ async function GET(req, ctx) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const progressService = container.resolve("progressService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const run = await syncRunService.getRun(parsed.data.id, scope);
   if (!run) {
     return NextResponse.json({ error: "Run not found" }, { status: 404 });
   }
   const progressJob = run.progressJobId ? await progressService.getJob(run.progressJobId, {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     userId: auth.sub
   }) : null;
   return NextResponse.json({

package/dist/modules/data_sync/api/runs/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/runs/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get sync run detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n\n  const progressJob = run.progressJobId\n    ? await progressService.getJob(run.progressJobId, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n    })\n    : null\n\n  return NextResponse.json({\n    id: run.id,\n    integrationId: run.integrationId,\n    entityType: run.entityType,\n    direction: run.direction,\n    status: run.status,\n    cursor: run.cursor ?? null,\n    initialCursor: run.initialCursor ?? null,\n    createdCount: run.createdCount,\n    updatedCount: run.updatedCount,\n    skippedCount: run.skippedCount,\n    failedCount: run.failedCount,\n    batchesCompleted: run.batchesCompleted,\n    lastError: run.lastError ?? null,\n    progressJobId: run.progressJobId ?? null,\n    progressJob: progressJob\n      ? {\n        id: progressJob.id,\n        status: progressJob.status,\n        progressPercent: progressJob.progressPercent,\n        processedCount: progressJob.processedCount,\n        totalCount: progressJob.totalCount ?? null,\n        etaSeconds: progressJob.etaSeconds ?? null,\n      }\n      : null,\n    triggeredBy: run.triggeredBy ?? null,\n    createdAt: run.createdAt.toISOString(),\n    updatedAt: run.updatedAt.toISOString(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAIvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,cAAc,IAAI,gBACpB,MAAM,gBAAgB,OAAO,IAAI,eAAe;AAAA,IAChD,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC,IACC;AAEJ,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,UAAU;AAAA,IACtB,eAAe,IAAI,iBAAiB;AAAA,IACpC,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,aAAa,IAAI;AAAA,IACjB,kBAAkB,IAAI;AAAA,IACtB,WAAW,IAAI,aAAa;AAAA,IAC5B,eAAe,IAAI,iBAAiB;AAAA,IACpC,aAAa,cACT;AAAA,MACA,IAAI,YAAY;AAAA,MAChB,QAAQ,YAAY;AAAA,MACpB,iBAAiB,YAAY;AAAA,MAC7B,gBAAgB,YAAY;AAAA,MAC5B,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,YAAY,cAAc;AAAA,IACxC,IACE;AAAA,IACJ,aAAa,IAAI,eAAe;AAAA,IAChC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { ProgressService } from '../../../../progress/lib/progressService'\nimport type { SyncRunService } from '../../../lib/sync-run-service'\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Get sync run detail',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsed = paramsSchema.safeParse(rawParams)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid run id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n  const progressService = container.resolve('progressService') as ProgressService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const run = await syncRunService.getRun(parsed.data.id, scope)\n  if (!run) {\n    return NextResponse.json({ error: 'Run not found' }, { status: 404 })\n  }\n\n  const progressJob = run.progressJobId\n    ? await progressService.getJob(run.progressJobId, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: auth.sub,\n    })\n    : null\n\n  return NextResponse.json({\n    id: run.id,\n    integrationId: run.integrationId,\n    entityType: run.entityType,\n    direction: run.direction,\n    status: run.status,\n    cursor: run.cursor ?? null,\n    initialCursor: run.initialCursor ?? null,\n    createdCount: run.createdCount,\n    updatedCount: run.updatedCount,\n    skippedCount: run.skippedCount,\n    failedCount: run.failedCount,\n    batchesCompleted: run.batchesCompleted,\n    lastError: run.lastError ?? null,\n    progressJobId: run.progressJobId ?? null,\n    progressJob: progressJob\n      ? {\n        id: progressJob.id,\n        status: progressJob.status,\n        progressPercent: progressJob.progressPercent,\n        processedCount: progressJob.processedCount,\n        totalCount: progressJob.totalCount ?? null,\n        etaSeconds: progressJob.etaSeconds ?? null,\n      }\n      : null,\n    triggeredBy: run.triggeredBy ?? null,\n    createdAt: run.createdAt.toISOString(),\n    updatedAt: run.updatedAt.toISOString(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AAIvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,SAAS,aAAa,UAAU,SAAS;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,MAAM,MAAM,eAAe,OAAO,OAAO,KAAK,IAAI,KAAK;AAC7D,MAAI,CAAC,KAAK;AACR,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,cAAc,IAAI,gBACpB,MAAM,gBAAgB,OAAO,IAAI,eAAe;AAAA,IAChD,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK;AAAA,EACf,CAAC,IACC;AAEJ,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI,IAAI;AAAA,IACR,eAAe,IAAI;AAAA,IACnB,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI,UAAU;AAAA,IACtB,eAAe,IAAI,iBAAiB;AAAA,IACpC,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,cAAc,IAAI;AAAA,IAClB,aAAa,IAAI;AAAA,IACjB,kBAAkB,IAAI;AAAA,IACtB,WAAW,IAAI,aAAa;AAAA,IAC5B,eAAe,IAAI,iBAAiB;AAAA,IACpC,aAAa,cACT;AAAA,MACA,IAAI,YAAY;AAAA,MAChB,QAAQ,YAAY;AAAA,MACpB,iBAAiB,YAAY;AAAA,MAC7B,gBAAgB,YAAY;AAAA,MAC5B,YAAY,YAAY,cAAc;AAAA,MACtC,YAAY,YAAY,cAAc;AAAA,IACxC,IACE;AAAA,IACJ,aAAa,IAAI,eAAe;AAAA,IAChC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,EACvC,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/runs.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { listSyncRunsQuerySchema } from "../data/validators.js";
 const metadata = {
@@ -11,9 +12,13 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const url = new URL(req.url);
   const parsed = listSyncRunsQuerySchema.safeParse({
     integrationId: url.searchParams.get("integrationId") ?? void 0,
@@ -30,7 +35,7 @@ async function GET(req) {
   const container = await createRequestContainer();
   const syncRunService = container.resolve("dataSyncRunService");
   const { items, total } = await syncRunService.listRuns(parsed.data, {
-    organizationId: auth.orgId,
+    organizationId,
     tenantId: auth.tenantId
   });
   return NextResponse.json({

package/dist/modules/data_sync/api/runs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/runs.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { listSyncRunsQuerySchema } from '../data/validators'\nimport type { SyncRunService } from '../lib/sync-run-service'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List sync runs',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncRunsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n\n  const { items, total } = await syncRunService.listRuns(parsed.data, {\n    organizationId: auth.orgId as string,\n    tenantId: auth.tenantId,\n  })\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      direction: item.direction,\n      status: item.status,\n      cursor: item.cursor ?? null,\n      initialCursor: item.initialCursor ?? null,\n      createdCount: item.createdCount,\n      updatedCount: item.updatedCount,\n      skippedCount: item.skippedCount,\n      failedCount: item.failedCount,\n      batchesCompleted: item.batchesCompleted,\n      lastError: item.lastError ?? null,\n      progressJobId: item.progressJobId ?? null,\n      triggeredBy: item.triggeredBy ?? null,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAE7D,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,eAAe,SAAS,OAAO,MAAM;AAAA,IAClE,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,WAAW,KAAK,aAAa;AAAA,MAC7B,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { listSyncRunsQuerySchema } from '../data/validators'\nimport type { SyncRunService } from '../lib/sync-run-service'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List sync runs',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncRunsQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n\n  const { items, total } = await syncRunService.listRuns(parsed.data, {\n    organizationId,\n    tenantId: auth.tenantId,\n  })\n\n  return NextResponse.json({\n    items: items.map((item) => ({\n      id: item.id,\n      integrationId: item.integrationId,\n      entityType: item.entityType,\n      direction: item.direction,\n      status: item.status,\n      cursor: item.cursor ?? null,\n      initialCursor: item.initialCursor ?? null,\n      createdCount: item.createdCount,\n      updatedCount: item.updatedCount,\n      skippedCount: item.skippedCount,\n      failedCount: item.failedCount,\n      batchesCompleted: item.batchesCompleted,\n      lastError: item.lastError ?? null,\n      progressJobId: item.progressJobId ?? null,\n      triggeredBy: item.triggeredBy ?? null,\n      createdAt: item.createdAt.toISOString(),\n      updatedAt: item.updatedAt.toISOString(),\n    })),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AAGjC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,wBAAwB,UAAU;AAAA,IAC/C,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAE7D,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,eAAe,SAAS,OAAO,MAAM;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,aAAa,KAAK;AAAA,MAClB,kBAAkB,KAAK;AAAA,MACvB,WAAW,KAAK,aAAa;AAAA,MAC7B,eAAe,KAAK,iBAAiB;AAAA,MACrC,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,IACxC,EAAE;AAAA,IACF;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/api/schedules/[id]/route.js

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { readOptimisticLockExpected } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
@@ -25,9 +26,13 @@ const openApi = {
 };
 async function GET(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -36,7 +41,7 @@ async function GET(req, ctx) {
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
   const schedule = await scheduleService.getById(parsedParams.data.id, {
-    organizationId: auth.orgId,
+    organizationId,
     tenantId: auth.tenantId
   });
   if (!schedule) {
@@ -46,9 +51,13 @@ async function GET(req, ctx) {
 }
 async function PUT(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -61,7 +70,7 @@ async function PUT(req, ctx) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const current = await scheduleService.getById(parsedParams.data.id, scope);
   if (!current) {
     return NextResponse.json({ error: "Schedule not found" }, { status: 404 });
@@ -117,9 +126,13 @@ async function PUT(req, ctx) {
 }
 async function DELETE(req, ctx) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const rawParams = ctx.params && typeof ctx.params.then === "function" ? await ctx.params : ctx.params;
   const parsedParams = paramsSchema.safeParse(rawParams);
   if (!parsedParams.success) {
@@ -127,7 +140,7 @@ async function DELETE(req, ctx) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId: scope.organizationId,

package/dist/modules/data_sync/api/schedules/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/data_sync/api/schedules/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { updateSyncScheduleSchema } from '../../../data/validators'\nimport type { SyncScheduleService } from '../../../lib/sync-schedule-service'\nimport { serializeSchedule } from '../serialize'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  PUT: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  DELETE: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Manage a sync schedule',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const schedule = await scheduleService.getById(parsedParams.data.id, {\n    organizationId: auth.orgId as string,\n    tenantId: auth.tenantId,\n  })\n\n  if (!schedule) {\n    return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n  }\n\n  return NextResponse.json(serializeSchedule(schedule))\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsed = updateSyncScheduleSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n  const current = await scheduleService.getById(parsedParams.data.id, scope)\n\n  if (!current) {\n    return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: current.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const schedule = await scheduleService.saveSchedule({\n      id: current.id,\n      integrationId: parsed.data.integrationId ?? current.integrationId,\n      entityType: parsed.data.entityType ?? current.entityType,\n      direction: parsed.data.direction ?? current.direction,\n      scheduleType: parsed.data.scheduleType ?? current.scheduleType,\n      scheduleValue: parsed.data.scheduleValue ?? current.scheduleValue,\n      timezone: parsed.data.timezone ?? current.timezone,\n      fullSync: parsed.data.fullSync ?? current.fullSync,\n      isEnabled: parsed.data.isEnabled ?? current.isEnabled,\n      expectedUpdatedAt: readOptimisticLockExpected(req),\n    }, scope, container)\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: schedule.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json(serializeSchedule(schedule))\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to update sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: parsedParams.data.id,\n    operation: 'delete',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: null,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const deleted = await scheduleService.deleteSchedule(\n      parsedParams.data.id,\n      scope,\n      container,\n      readOptimisticLockExpected(req),\n    )\n\n    if (!deleted) {\n      return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n    }\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: parsedParams.data.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ deleted: true })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to delete sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB;AAChC,SAAS,gCAAgC;AAEzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,WAAW,MAAM,gBAAgB,QAAQ,aAAa,KAAK,IAAI;AAAA,IACnE,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,SAAO,aAAa,KAAK,kBAAkB,QAAQ,CAAC;AACtD;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAC9E,QAAM,UAAU,MAAM,gBAAgB,QAAQ,aAAa,KAAK,IAAI,KAAK;AAEzE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,gBAAgB,aAAa;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,eAAe,OAAO,KAAK,iBAAiB,QAAQ;AAAA,MACpD,YAAY,OAAO,KAAK,cAAc,QAAQ;AAAA,MAC9C,WAAW,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC5C,cAAc,OAAO,KAAK,gBAAgB,QAAQ;AAAA,MAClD,eAAe,OAAO,KAAK,iBAAiB,QAAQ;AAAA,MACpD,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,MAC1C,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,MAC1C,WAAW,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC5C,mBAAmB,2BAA2B,GAAG;AAAA,IACnD,GAAG,OAAO,SAAS;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,kBAAkB,QAAQ,CAAC;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEA,eAAsB,OAAO,KAAc,KAA8D;AACvG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,aAAa,KAAK;AAAA,IAC9B,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,gBAAgB;AAAA,MACpC,aAAa,KAAK;AAAA,MAClB;AAAA,MACA;AAAA,MACA,2BAA2B,GAAG;AAAA,IAChC;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,aAAa,KAAK;AAAA,QAC9B,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,EAC5C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { updateSyncScheduleSchema } from '../../../data/validators'\nimport type { SyncScheduleService } from '../../../lib/sync-schedule-service'\nimport { serializeSchedule } from '../serialize'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  PUT: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  DELETE: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Manage a sync schedule',\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const schedule = await scheduleService.getById(parsedParams.data.id, {\n    organizationId,\n    tenantId: auth.tenantId,\n  })\n\n  if (!schedule) {\n    return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n  }\n\n  return NextResponse.json(serializeSchedule(schedule))\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsed = updateSyncScheduleSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId, tenantId: auth.tenantId }\n  const current = await scheduleService.getById(parsedParams.data.id, scope)\n\n  if (!current) {\n    return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: current.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const schedule = await scheduleService.saveSchedule({\n      id: current.id,\n      integrationId: parsed.data.integrationId ?? current.integrationId,\n      entityType: parsed.data.entityType ?? current.entityType,\n      direction: parsed.data.direction ?? current.direction,\n      scheduleType: parsed.data.scheduleType ?? current.scheduleType,\n      scheduleValue: parsed.data.scheduleValue ?? current.scheduleValue,\n      timezone: parsed.data.timezone ?? current.timezone,\n      fullSync: parsed.data.fullSync ?? current.fullSync,\n      isEnabled: parsed.data.isEnabled ?? current.isEnabled,\n      expectedUpdatedAt: readOptimisticLockExpected(req),\n    }, scope, container)\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: schedule.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json(serializeSchedule(schedule))\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to update sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const rawParams = (ctx.params && typeof (ctx.params as Promise<unknown>).then === 'function')\n    ? await (ctx.params as Promise<{ id?: string }>)\n    : (ctx.params as { id?: string } | undefined)\n\n  const parsedParams = paramsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid schedule id' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: parsedParams.data.id,\n    operation: 'delete',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: null,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const deleted = await scheduleService.deleteSchedule(\n      parsedParams.data.id,\n      scope,\n      container,\n      readOptimisticLockExpected(req),\n    )\n\n    if (!deleted) {\n      return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })\n    }\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: parsedParams.data.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ deleted: true })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to delete sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB;AAChC,SAAS,gCAAgC;AAEzC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,WAAW,MAAM,gBAAgB,QAAQ,aAAa,KAAK,IAAI;AAAA,IACnE;AAAA,IACA,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,SAAO,aAAa,KAAK,kBAAkB,QAAQ,CAAC;AACtD;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AACxD,QAAM,UAAU,MAAM,gBAAgB,QAAQ,aAAa,KAAK,IAAI,KAAK;AAEzE,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,gBAAgB,aAAa;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,eAAe,OAAO,KAAK,iBAAiB,QAAQ;AAAA,MACpD,YAAY,OAAO,KAAK,cAAc,QAAQ;AAAA,MAC9C,WAAW,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC5C,cAAc,OAAO,KAAK,gBAAgB,QAAQ;AAAA,MAClD,eAAe,OAAO,KAAK,iBAAiB,QAAQ;AAAA,MACpD,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,MAC1C,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,MAC1C,WAAW,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC5C,mBAAmB,2BAA2B,GAAG;AAAA,IACnD,GAAG,OAAO,SAAS;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,kBAAkB,QAAQ,CAAC;AAAA,EACtD,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;AAEA,eAAsB,OAAO,KAAc,KAA8D;AACvG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAa,IAAI,UAAU,OAAQ,IAAI,OAA4B,SAAS,aAC9E,MAAO,IAAI,SACV,IAAI;AAET,QAAM,eAAe,aAAa,UAAU,SAAS;AACrD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,aAAa,KAAK;AAAA,IAC9B,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,UAAU,MAAM,gBAAgB;AAAA,MACpC,aAAa,KAAK;AAAA,MAClB;AAAA,MACA;AAAA,MACA,2BAA2B,GAAG;AAAA,IAChC;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3E;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,aAAa,KAAK;AAAA,QAC9B,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,EAC5C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;",
   "names": []
 }

package/dist/modules/data_sync/api/schedules/route.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { createSyncScheduleSchema, listSyncSchedulesQuerySchema } from "../../data/validators.js";
@@ -20,9 +21,13 @@ const openApi = {
 };
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const url = new URL(req.url);
   const parsed = listSyncSchedulesQuerySchema.safeParse({
     integrationId: url.searchParams.get("integrationId") ?? void 0,
@@ -36,7 +41,7 @@ async function GET(req) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const { items, total } = await scheduleService.listSchedules(parsed.data, scope);
   return NextResponse.json({
     items: items.map(serializeSchedule),
@@ -48,9 +53,13 @@ async function GET(req) {
 }
 async function POST(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const payload = await readJsonSafe(req);
   const parsed = createSyncScheduleSchema.safeParse(payload);
   if (!parsed.success) {
@@ -58,7 +67,7 @@ async function POST(req) {
   }
   const container = await createRequestContainer();
   const scheduleService = container.resolve("dataSyncScheduleService");
-  const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const scope = { organizationId, tenantId: auth.tenantId };
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId: scope.organizationId,

package/dist/modules/data_sync/api/schedules/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/data_sync/api/schedules/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { createSyncScheduleSchema, listSyncSchedulesQuerySchema } from '../../data/validators'\nimport type { SyncScheduleService } from '../../lib/sync-schedule-service'\nimport { serializeSchedule } from './serialize'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create sync schedules',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncSchedulesQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n  const { items, total } = await scheduleService.listSchedules(parsed.data, scope)\n\n  return NextResponse.json({\n    items: items.map(serializeSchedule),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsed = createSyncScheduleSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: scope.organizationId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const schedule = await scheduleService.saveSchedule({\n      ...parsed.data,\n      expectedUpdatedAt: readOptimisticLockExpected(req),\n    }, scope, container)\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: schedule.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json(serializeSchedule(schedule), { status: 201 })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to save sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B,oCAAoC;AAEvE,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,6BAA6B,UAAU;AAAA,IACpD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAC9E,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,gBAAgB,cAAc,OAAO,MAAM,KAAK;AAE/E,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,iBAAiB;AAAA,IAClC;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,gBAAgB,aAAa;AAAA,MAClD,GAAG,OAAO;AAAA,MACV,mBAAmB,2BAA2B,GAAG;AAAA,IACnD,GAAG,OAAO,SAAS;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { createSyncScheduleSchema, listSyncSchedulesQuerySchema } from '../../data/validators'\nimport type { SyncScheduleService } from '../../lib/sync-schedule-service'\nimport { serializeSchedule } from './serialize'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List or create sync schedules',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const url = new URL(req.url)\n  const parsed = listSyncSchedulesQuerySchema.safeParse({\n    integrationId: url.searchParams.get('integrationId') ?? undefined,\n    entityType: url.searchParams.get('entityType') ?? undefined,\n    direction: url.searchParams.get('direction') ?? undefined,\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query', details: parsed.error.flatten() }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId, tenantId: auth.tenantId }\n  const { items, total } = await scheduleService.listSchedules(parsed.data, scope)\n\n  return NextResponse.json({\n    items: items.map(serializeSchedule),\n    total,\n    page: parsed.data.page,\n    pageSize: parsed.data.pageSize,\n    totalPages: Math.max(1, Math.ceil(total / parsed.data.pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const payload = await readJsonSafe(req)\n  const parsed = createSyncScheduleSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: 'data_sync.schedule',\n    resourceId: scope.organizationId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  try {\n    const schedule = await scheduleService.saveSchedule({\n      ...parsed.data,\n      expectedUpdatedAt: readOptimisticLockExpected(req),\n    }, scope, container)\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: scope.organizationId,\n        userId: auth.sub,\n        resourceKind: 'data_sync.schedule',\n        resourceId: schedule.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json(serializeSchedule(schedule), { status: 201 })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    const message = error instanceof Error ? error.message : 'Failed to save sync schedule'\n    return NextResponse.json({ error: message }, { status: 422 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B,oCAAoC;AAEvE,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACnE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,6BAA6B,UAAU;AAAA,IACpD,eAAe,IAAI,aAAa,IAAI,eAAe,KAAK;AAAA,IACxD,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,WAAW,IAAI,aAAa,IAAI,WAAW,KAAK;AAAA,IAChD,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AAED,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AACxD,QAAM,EAAE,OAAO,MAAM,IAAI,MAAM,gBAAgB,cAAc,OAAO,MAAM,KAAK;AAE/E,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,iBAAiB;AAAA,IAClC;AAAA,IACA,MAAM,OAAO,KAAK;AAAA,IAClB,UAAU,OAAO,KAAK;AAAA,IACtB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,KAAK,QAAQ,CAAC;AAAA,EACjE,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,kBAAkB,UAAU,QAAQ,yBAAyB;AACnE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,gBAAgB,aAAa;AAAA,MAClD,GAAG,OAAO;AAAA,MACV,mBAAmB,2BAA2B,GAAG;AAAA,IACnD,GAAG,OAAO,SAAS;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9D;AACF;",
   "names": []
 }

package/dist/modules/data_sync/api/validate.js

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "@open-mercato/shared/lib/auth/organizationScope";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getIntegration } from "@open-mercato/shared/modules/integrations/types";
 import { validateConnectionSchema } from "../data/validators.js";
@@ -13,9 +14,13 @@ const openApi = {
 };
 async function POST(req) {
   const auth = await getAuthFromRequest(req);
-  if (!auth?.tenantId || !auth.orgId) {
+  if (!auth?.tenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  const organizationId = resolveActiveOrganizationId(auth);
+  if (!organizationId) {
+    return organizationScopeRequiredResponse();
+  }
   const parsed = validateConnectionSchema.safeParse(await req.json());
   if (!parsed.success) {
     return NextResponse.json({ error: "Invalid payload", details: parsed.error.flatten() }, { status: 422 });
@@ -31,7 +36,7 @@ async function POST(req) {
   const container = await createRequestContainer();
   const credentialsService = container.resolve("integrationCredentialsService");
   const credentials = await credentialsService.resolve(integration.id, {
-    organizationId: auth.orgId,
+    organizationId,
     tenantId: auth.tenantId
   });
   if (!credentials) {
@@ -40,7 +45,7 @@ async function POST(req) {
   const mapping = await adapter.getMapping({
     entityType: parsed.data.entityType,
     scope: {
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     }
   });
@@ -52,7 +57,7 @@ async function POST(req) {
     credentials,
     mapping,
     scope: {
-      organizationId: auth.orgId,
+      organizationId,
       tenantId: auth.tenantId
     }
   });

package/dist/modules/data_sync/api/validate.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/validate.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport { validateConnectionSchema } from '../data/validators'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Validate sync connection',\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const parsed = validateConnectionSchema.safeParse(await req.json())\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const integration = getIntegration(parsed.data.integrationId)\n  if (!integration?.providerKey) {\n    return NextResponse.json({ ok: false, message: 'Integration or providerKey not found' }, { status: 404 })\n  }\n\n  const adapter = getDataSyncAdapter(integration.providerKey)\n  if (!adapter) {\n    return NextResponse.json({ ok: false, message: 'No registered sync adapter for provider' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const credentials = await credentialsService.resolve(integration.id, {\n    organizationId: auth.orgId as string,\n    tenantId: auth.tenantId,\n  })\n\n  if (!credentials) {\n    return NextResponse.json({ ok: false, message: 'Missing credentials' }, { status: 422 })\n  }\n\n  const mapping = await adapter.getMapping({\n    entityType: parsed.data.entityType,\n    scope: {\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n  })\n\n  if (!adapter.validateConnection) {\n    return NextResponse.json({ ok: true, message: 'Adapter does not implement active connection validation' })\n  }\n\n  const result = await adapter.validateConnection({\n    entityType: parsed.data.entityType,\n    credentials,\n    mapping,\n    scope: {\n      organizationId: auth.orgId as string,\n      tenantId: auth.tenantId,\n    },\n  })\n\n  return NextResponse.json(result, { status: result.ok ? 200 : 422 })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAE/B,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,SAAS,yBAAyB,UAAU,MAAM,IAAI,KAAK,CAAC;AAClE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,MAAI,CAAC,aAAa,aAAa;AAC7B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1G;AAEA,QAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,cAAc,MAAM,mBAAmB,QAAQ,YAAY,IAAI;AAAA,IACnE,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AAEA,QAAM,UAAU,MAAM,QAAQ,WAAW;AAAA,IACvC,YAAY,OAAO,KAAK;AAAA,IACxB,OAAO;AAAA,MACL,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,QAAQ,oBAAoB;AAC/B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,0DAA0D,CAAC;AAAA,EAC3G;AAEA,QAAM,SAAS,MAAM,QAAQ,mBAAmB;AAAA,IAC9C,YAAY,OAAO,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,OAAO,KAAK,MAAM,IAAI,CAAC;AACpE;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport { validateConnectionSchema } from '../data/validators'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['data_sync.configure'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'Validate sync connection',\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const parsed = validateConnectionSchema.safeParse(await req.json())\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', details: parsed.error.flatten() }, { status: 422 })\n  }\n\n  const integration = getIntegration(parsed.data.integrationId)\n  if (!integration?.providerKey) {\n    return NextResponse.json({ ok: false, message: 'Integration or providerKey not found' }, { status: 404 })\n  }\n\n  const adapter = getDataSyncAdapter(integration.providerKey)\n  if (!adapter) {\n    return NextResponse.json({ ok: false, message: 'No registered sync adapter for provider' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const credentials = await credentialsService.resolve(integration.id, {\n    organizationId,\n    tenantId: auth.tenantId,\n  })\n\n  if (!credentials) {\n    return NextResponse.json({ ok: false, message: 'Missing credentials' }, { status: 422 })\n  }\n\n  const mapping = await adapter.getMapping({\n    entityType: parsed.data.entityType,\n    scope: {\n      organizationId,\n      tenantId: auth.tenantId,\n    },\n  })\n\n  if (!adapter.validateConnection) {\n    return NextResponse.json({ ok: true, message: 'Adapter does not implement active connection validation' })\n  }\n\n  const result = await adapter.validateConnection({\n    entityType: parsed.data.entityType,\n    credentials,\n    mapping,\n    scope: {\n      organizationId,\n      tenantId: auth.tenantId,\n    },\n  })\n\n  return NextResponse.json(result, { status: result.ok ? 200 : 422 })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAE/B,SAAS,gCAAgC;AACzC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,SAAS,yBAAyB,UAAU,MAAM,IAAI,KAAK,CAAC;AAClE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,cAAc,eAAe,OAAO,KAAK,aAAa;AAC5D,MAAI,CAAC,aAAa,aAAa;AAC7B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1G;AAEA,QAAM,UAAU,mBAAmB,YAAY,WAAW;AAC1D,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,cAAc,MAAM,mBAAmB,QAAQ,YAAY,IAAI;AAAA,IACnE;AAAA,IACA,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzF;AAEA,QAAM,UAAU,MAAM,QAAQ,WAAW;AAAA,IACvC,YAAY,OAAO,KAAK;AAAA,IACxB,OAAO;AAAA,MACL;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI,CAAC,QAAQ,oBAAoB;AAC/B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,0DAA0D,CAAC;AAAA,EAC3G;AAEA,QAAM,SAAS,MAAM,QAAQ,mBAAmB;AAAA,IAC9C,YAAY,OAAO,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,OAAO,KAAK,MAAM,IAAI,CAAC;AACpE;",
   "names": []
 }

package/dist/modules/data_sync/backend/data-sync/page.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
+import { extensionPoints } from "@open-mercato/core/modules/data_sync/extension-points";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
@@ -767,9 +768,9 @@ function SyncRunsDashboardPage() {
             ] })
           ] })
         ] }),
-        selectedIntegration && !selectedIntegration.isEnabled ? /* @__PURE__ */ jsx(Alert, { variant: "warning", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("integrations.detail.state.disabled", "This integration is disabled. Enable it on the integration settings page before starting a sync.") }) }) : null,
-        selectedIntegration && !selectedIntegration.hasCredentials ? /* @__PURE__ */ jsx(Alert, { variant: "warning", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("integrations.detail.credentials.notConfigured", "Credentials are not configured yet. Save the integration credentials before starting a sync.") }) }) : null,
-        selectedIntegration && selectedIntegration.canStartRun === false ? /* @__PURE__ */ jsx(Alert, { variant: "info", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("data_sync.dashboard.start.providerManaged", "This integration starts sync runs from its own setup flow. Open the integration settings page to continue.") }) }) : null
+        selectedIntegration && !selectedIntegration.isEnabled ? /* @__PURE__ */ jsx(Alert, { status: "warning", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("integrations.detail.state.disabled", "This integration is disabled. Enable it on the integration settings page before starting a sync.") }) }) : null,
+        selectedIntegration && !selectedIntegration.hasCredentials ? /* @__PURE__ */ jsx(Alert, { status: "warning", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("integrations.detail.credentials.notConfigured", "Credentials are not configured yet. Save the integration credentials before starting a sync.") }) }) : null,
+        selectedIntegration && selectedIntegration.canStartRun === false ? /* @__PURE__ */ jsx(Alert, { status: "information", children: /* @__PURE__ */ jsx(AlertDescription, { children: t("data_sync.dashboard.start.providerManaged", "This integration starts sync runs from its own setup flow. Open the integration settings page to continue.") }) }) : null
       ] })
     ] }),
     /* @__PURE__ */ jsx(
@@ -789,7 +790,7 @@ function SyncRunsDashboardPage() {
           setPage(1);
         },
         searchPlaceholder: t("data_sync.dashboard.searchPlaceholder"),
-        perspective: { tableId: "data_sync.runs" },
+        perspective: { tableId: extensionPoints.hosts.runsTable.tableId },
         onRowClick: (row) => {
           router.push(`/backend/data-sync/runs/${encodeURIComponent(row.id)}`);
         },