@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/shipping_carriers/api/webhook/[provider]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/shipping_carriers/api/webhook/%5Bprovider%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { CarrierShipment } from '../../../data/entities'\nimport { getShippingAdapter } from '../../../lib/adapter-registry'\nimport { getShippingCarrierQueue } from '../../../lib/queue'\nimport { shippingCarriersTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('shipping_carriers').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/shipping-carriers/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\n\nconst shippingCarrierWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'shipping_carriers:webhook',\n}\n\nfunction readCarrierShipmentId(payload: Record<string, unknown> | null): string | null {\n  if (!payload) return null\n  const shipmentId = payload.shipmentId\n  if (typeof shipmentId === 'string' && shipmentId.trim().length > 0) return shipmentId.trim()\n  const data = payload.data\n  if (data && typeof data === 'object') {\n    const nested = (data as Record<string, unknown>).shipmentId\n    if (typeof nested === 'string' && nested.trim().length > 0) return nested.trim()\n  }\n  return null\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const adapter = getShippingAdapter(providerKey)\n  if (!adapter) {\n    return NextResponse.json({ error: `No shipping adapter for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  if (rateLimitResponse) return rateLimitResponse\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getShippingCarrierQueue('shipping-carriers-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)\n  const carrierShipmentId = readCarrierShipmentId(payload)\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // CarrierShipment whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata or an unsigned retry.\n    // If no candidate shipment can be located by the provider-reported carrierShipmentId,\n    // or no candidate's credentials can verify the signature, we fail closed with 401.\n    // This mirrors the fix landed for payment_gateways in PR #1311.\n    const candidates = carrierShipmentId\n      ? await findWithDecryption(\n        em,\n        CarrierShipment,\n        {\n          providerKey,\n          carrierShipmentId,\n          deletedAt: null,\n        },\n        { limit: 10, orderBy: { createdAt: 'desc' } },\n      )\n      : []\n\n    let shipment: CarrierShipment | null = null\n    let matchedScope: { organizationId: string; tenantId: string } | null = null\n    let event: Awaited<ReturnType<typeof adapter.verifyWebhook>> | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      const credentials = await integrationCredentialsService.resolve(`carrier_${providerKey}`, candidateScope) ?? {}\n      try {\n        event = await adapter.verifyWebhook({ rawBody, headers, credentials })\n        shipment = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !shipment || !matchedScope) {\n      throw lastVerificationError ?? new Error('Webhook verification failed: no matching shipment')\n    }\n\n    await queue.enqueue({\n      name: 'shipping-carrier-webhook',\n      payload: {\n        providerKey,\n        event,\n        shipmentId: shipment.id,\n        scope: matchedScope,\n      },\n    })\n\n    return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  } catch (error: unknown) {\n    logger.warn('Webhook verification failed', { providerKey, err: error })\n    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n  }\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    shippingCarrierWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [shippingCarriersTag],\n  summary: 'Receive shipping carrier webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound carrier webhook',\n      tags: [shippingCarriersTag],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAIvE,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAExE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AAEpC,MAAM,wCAAwC;AAAA,EAC5C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAEA,SAAS,sBAAsB,SAAwD;AACrF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,KAAK,EAAE,SAAS,EAAG,QAAO,WAAW,KAAK;AAC3F,QAAM,OAAO,QAAQ;AACrB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,SAAU,KAAiC;AACjD,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAAA,EACjF;AACA,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,UAAU,mBAAmB,WAAW;AAC9C,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,MAAI,kBAAmB,QAAO;AAE9B,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,wBAAwB,2BAA2B;AACjE,QAAM,UAAU,MAAM,aAAsC,OAAO;AACnE,QAAM,oBAAoB,sBAAsB,OAAO;AAEvD,MAAI;AAOF,UAAM,aAAa,oBACf,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC9C,IACE,CAAC;AAEL,QAAI,WAAmC;AACvC,QAAI,eAAoE;AACxE,QAAI,QAAkE;AACtE,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,YAAM,cAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAC9G,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc,EAAE,SAAS,SAAS,YAAY,CAAC;AACrE,mBAAW;AACX,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,cAAc;AACxC,YAAM,yBAAyB,IAAI,MAAM,mDAAmD;AAAA,IAC9F;AAEA,UAAM,MAAM,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,OAAgB;AACvB,WAAO,KAAK,+BAA+B,EAAE,aAAa,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,mBAAmB;AAAA,EAC1B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,mBAAmB;AAAA,MAC1B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { checkRateLimit, getClientIp, RATE_LIMIT_ERROR_FALLBACK } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CredentialsService } from '../../../../integrations/lib/credentials-service'\nimport { CarrierShipment } from '../../../data/entities'\nimport { getShippingAdapter } from '../../../lib/adapter-registry'\nimport { getShippingCarrierQueue } from '../../../lib/queue'\nimport { shippingCarriersTag } from '../../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('shipping_carriers').child({ component: 'webhook' })\n\nexport const metadata = {\n  path: '/shipping-carriers/webhook/[provider]',\n  POST: { requireAuth: false },\n}\n\nconst WEBHOOK_VERIFICATION_FAILED = 'Webhook verification failed'\n\nconst shippingCarrierWebhookRateLimitConfig = {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'shipping_carriers:webhook',\n}\n\nfunction readCarrierShipmentId(payload: Record<string, unknown> | null): string | null {\n  if (!payload) return null\n  const shipmentId = payload.shipmentId\n  if (typeof shipmentId === 'string' && shipmentId.trim().length > 0) return shipmentId.trim()\n  const data = payload.data\n  if (data && typeof data === 'object') {\n    const nested = (data as Record<string, unknown>).shipmentId\n    if (typeof nested === 'string' && nested.trim().length > 0) return nested.trim()\n  }\n  return null\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ provider: string }> | { provider: string } }) {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n  const adapter = getShippingAdapter(providerKey)\n  if (!adapter) {\n    return NextResponse.json({ error: `No shipping adapter for provider: ${providerKey}` }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)\n  if (rateLimitResponse) return rateLimitResponse\n\n  let rawBody: string\n  try {\n    rawBody = await readBoundedRequestBody(req)\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const em = container.resolve('em') as EntityManager\n  const integrationCredentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const queue = getShippingCarrierQueue('shipping-carriers-webhook')\n  const payload = await readJsonSafe<Record<string, unknown>>(rawBody)\n  const carrierShipmentId = readCarrierShipmentId(payload)\n\n  try {\n    // The webhook endpoint is unauthenticated. Tenant/organization scope MUST come from a\n    // CarrierShipment whose per-tenant credentials successfully verify the inbound\n    // signature \u2014 NEVER from attacker-controlled payload metadata or an unsigned retry.\n    // If no candidate shipment can be located by the provider-reported carrierShipmentId,\n    // or no candidate's credentials can verify the signature, we fail closed with 401.\n    // This mirrors the fix landed for payment_gateways in PR #1311.\n    const candidates = carrierShipmentId\n      ? await findWithDecryption(\n        em,\n        CarrierShipment,\n        {\n          providerKey,\n          carrierShipmentId,\n          deletedAt: null,\n        },\n        { limit: 10, orderBy: { createdAt: 'desc' } },\n      )\n      : []\n\n    let shipment: CarrierShipment | null = null\n    let matchedScope: { organizationId: string; tenantId: string } | null = null\n    let event: Awaited<ReturnType<typeof adapter.verifyWebhook>> | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates) {\n      const candidateScope = { organizationId: candidate.organizationId, tenantId: candidate.tenantId }\n      const credentials = await integrationCredentialsService.resolve(`carrier_${providerKey}`, candidateScope) ?? {}\n      try {\n        event = await adapter.verifyWebhook({ rawBody, headers, credentials })\n        shipment = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !shipment || !matchedScope) {\n      throw lastVerificationError ?? new Error('Webhook verification failed: no matching shipment')\n    }\n\n    await queue.enqueue({\n      name: 'shipping-carrier-webhook',\n      payload: {\n        providerKey,\n        event,\n        shipmentId: shipment.id,\n        scope: matchedScope,\n      },\n    })\n\n    return NextResponse.json({ received: true, queued: true }, { status: 202 })\n  } catch (error: unknown) {\n    logger.warn('Webhook verification failed', { providerKey, err: error })\n    return NextResponse.json({ error: WEBHOOK_VERIFICATION_FAILED }, { status: 401 })\n  }\n}\n\nasync function checkProviderWebhookRateLimit(\n  container: { resolve: (name: string) => unknown },\n  req: Request,\n  providerKey: string,\n): Promise<NextResponse | null> {\n  const rateLimiterService = tryResolve<RateLimiterService>(container, 'rateLimiterService')\n  if (!rateLimiterService) return null\n\n  return checkRateLimit(\n    rateLimiterService,\n    shippingCarrierWebhookRateLimitConfig,\n    `${providerKey}:${getClientIp(req, rateLimiterService.trustProxyDepth) ?? 'unknown'}`,\n    RATE_LIMIT_ERROR_FALLBACK,\n  )\n}\n\nfunction tryResolve<T>(container: { resolve: (name: string) => unknown }, name: string): T | null {\n  try {\n    return container.resolve(name) as T\n  } catch {\n    return null\n  }\n}\n\nexport const openApi = {\n  tags: [shippingCarriersTag],\n  summary: 'Receive shipping carrier webhook',\n  methods: {\n    POST: {\n      summary: 'Process inbound carrier webhook',\n      tags: [shippingCarriersTag],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB,aAAa,iCAAiC;AAIvE,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAExE,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,8BAA8B;AAEpC,MAAM,wCAAwC;AAAA,EAC5C,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb;AAEA,SAAS,sBAAsB,SAAwD;AACrF,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,aAAa,QAAQ;AAC3B,MAAI,OAAO,eAAe,YAAY,WAAW,KAAK,EAAE,SAAS,EAAG,QAAO,WAAW,KAAK;AAC3F,QAAM,OAAO,QAAQ;AACrB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,SAAU,KAAiC;AACjD,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAAA,EACjF;AACA,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAqE;AACrH,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,UAAU,mBAAmB,WAAW;AAC9C,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,WAAW,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,MAAM,8BAA8B,WAAW,KAAK,WAAW;AACzF,MAAI,kBAAmB,QAAO;AAE9B,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,uBAAuB,GAAG;AAAA,EAC5C,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,gCAAgC,UAAU,QAAQ,+BAA+B;AACvF,QAAM,QAAQ,wBAAwB,2BAA2B;AACjE,QAAM,UAAU,MAAM,aAAsC,OAAO;AACnE,QAAM,oBAAoB,sBAAsB,OAAO;AAEvD,MAAI;AAOF,UAAM,aAAa,oBACf,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA,EAAE,OAAO,IAAI,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IAC9C,IACE,CAAC;AAEL,QAAI,WAAmC;AACvC,QAAI,eAAoE;AACxE,QAAI,QAAkE;AACtE,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAY;AAClC,YAAM,iBAAiB,EAAE,gBAAgB,UAAU,gBAAgB,UAAU,UAAU,SAAS;AAChG,YAAM,cAAc,MAAM,8BAA8B,QAAQ,WAAW,WAAW,IAAI,cAAc,KAAK,CAAC;AAC9G,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc,EAAE,SAAS,SAAS,YAAY,CAAC;AACrE,mBAAW;AACX,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,YAAY,CAAC,cAAc;AACxC,YAAM,yBAAyB,IAAI,MAAM,mDAAmD;AAAA,IAC9F;AAEA,UAAM,MAAM,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,SAAS;AAAA,QACP;AAAA,QACA;AAAA,QACA,YAAY,SAAS;AAAA,QACrB,OAAO;AAAA,MACT;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,OAAgB;AACvB,WAAO,KAAK,+BAA+B,EAAE,aAAa,KAAK,MAAM,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,8BACb,WACA,KACA,aAC8B;AAC9B,QAAM,qBAAqB,WAA+B,WAAW,oBAAoB;AACzF,MAAI,CAAC,mBAAoB,QAAO;AAEhC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,WAAW,IAAI,YAAY,KAAK,mBAAmB,eAAe,KAAK,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,WAAc,WAAmD,MAAwB;AAChG,MAAI;AACF,WAAO,UAAU,QAAQ,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,mBAAmB;AAAA,EAC1B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,mBAAmB;AAAA,MAC1B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,QAC5D,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/shipping_carriers/lib/shipment-wizard/components/PackageEditor.js

@@ -39,7 +39,7 @@ const PackageEditor = (props) => {
             type: "button",
             variant: "ghost",
             size: "sm",
-            className: "h-auto px-2 py-0.5 text-xs text-red-600 hover:text-red-700",
+            className: "h-auto px-2 py-0.5 text-xs text-destructive hover:text-destructive/80",
             onClick: () => removePackage(index),
             disabled,
             children: t("shipping_carriers.create.package.remove", "Remove")

package/dist/modules/shipping_carriers/lib/shipment-wizard/components/PackageEditor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/shipping_carriers/lib/shipment-wizard/components/PackageEditor.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { PackageDimension, PackageEditorProps } from '../types'\n\nconst PACKAGE_FIELDS = ['weightKg', 'lengthCm', 'widthCm', 'heightCm'] as const\n\nconst DEFAULT_PACKAGE: PackageDimension = { weightKg: 1, lengthCm: 20, widthCm: 15, heightCm: 10 }\n\nexport const PackageEditor = (props: PackageEditorProps) => {\n  const { packages, onChange, disabled } = props\n  const t = useT()\n\n  const fieldLabel = (field: keyof PackageDimension) => {\n    const labels: Record<keyof PackageDimension, string> = {\n      weightKg: t('shipping_carriers.create.package.weightKg', 'Weight (kg)'),\n      lengthCm: t('shipping_carriers.create.package.lengthCm', 'Length (cm)'),\n      widthCm: t('shipping_carriers.create.package.widthCm', 'Width (cm)'),\n      heightCm: t('shipping_carriers.create.package.heightCm', 'Height (cm)'),\n    }\n    return labels[field]\n  }\n\n  const updatePackage = (index: number, field: keyof PackageDimension, raw: string) => {\n    const value = parseFloat(raw)\n    onChange(packages.map((pkg, idx) =>\n      idx === index ? { ...pkg, [field]: Number.isNaN(value) ? 0 : value } : pkg,\n    ))\n  }\n\n  const addPackage = () => onChange([...packages, DEFAULT_PACKAGE])\n\n  const removePackage = (index: number) => onChange(packages.filter((_, idx) => idx !== index))\n\n  return (\n    <div className=\"space-y-3\">\n      {packages.map((pkg, index) => (\n        <div key={index} className=\"rounded-lg border bg-muted/30 p-3\">\n          <div className=\"mb-2 flex items-center justify-between\">\n            <span className=\"text-xs font-medium text-muted-foreground\">\n              {t('shipping_carriers.create.package.label', 'Package')} {index + 1}\n            </span>\n            {packages.length > 1 ? (\n              <Button\n                type=\"button\"\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-auto px-2 py-0.5 text-xs text-red-600 hover:text-red-700\"\n                onClick={() => removePackage(index)}\n                disabled={disabled}\n              >\n                {t('shipping_carriers.create.package.remove', 'Remove')}\n              </Button>\n            ) : null}\n          </div>\n          <div className=\"grid gap-3 sm:grid-cols-4\">\n            {PACKAGE_FIELDS.map((field) => (\n              <div key={field}>\n                <label className=\"mb-1 block text-xs font-medium text-muted-foreground\">\n                  {fieldLabel(field)}\n                </label>\n                <Input\n                  type=\"number\"\n                  min=\"0.01\"\n                  step=\"0.01\"\n                  value={pkg[field]}\n                  onChange={(event) => updatePackage(index, field, event.target.value)}\n                  disabled={disabled}\n                />\n              </div>\n            ))}\n          </div>\n        </div>\n      ))}\n      <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={addPackage} disabled={disabled}>\n        {t('shipping_carriers.create.package.add', '+ Add package')}\n      </Button>\n    </div>\n  )\n}\n"],
+  "sourcesContent": ["\"use client\"\n\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { PackageDimension, PackageEditorProps } from '../types'\n\nconst PACKAGE_FIELDS = ['weightKg', 'lengthCm', 'widthCm', 'heightCm'] as const\n\nconst DEFAULT_PACKAGE: PackageDimension = { weightKg: 1, lengthCm: 20, widthCm: 15, heightCm: 10 }\n\nexport const PackageEditor = (props: PackageEditorProps) => {\n  const { packages, onChange, disabled } = props\n  const t = useT()\n\n  const fieldLabel = (field: keyof PackageDimension) => {\n    const labels: Record<keyof PackageDimension, string> = {\n      weightKg: t('shipping_carriers.create.package.weightKg', 'Weight (kg)'),\n      lengthCm: t('shipping_carriers.create.package.lengthCm', 'Length (cm)'),\n      widthCm: t('shipping_carriers.create.package.widthCm', 'Width (cm)'),\n      heightCm: t('shipping_carriers.create.package.heightCm', 'Height (cm)'),\n    }\n    return labels[field]\n  }\n\n  const updatePackage = (index: number, field: keyof PackageDimension, raw: string) => {\n    const value = parseFloat(raw)\n    onChange(packages.map((pkg, idx) =>\n      idx === index ? { ...pkg, [field]: Number.isNaN(value) ? 0 : value } : pkg,\n    ))\n  }\n\n  const addPackage = () => onChange([...packages, DEFAULT_PACKAGE])\n\n  const removePackage = (index: number) => onChange(packages.filter((_, idx) => idx !== index))\n\n  return (\n    <div className=\"space-y-3\">\n      {packages.map((pkg, index) => (\n        <div key={index} className=\"rounded-lg border bg-muted/30 p-3\">\n          <div className=\"mb-2 flex items-center justify-between\">\n            <span className=\"text-xs font-medium text-muted-foreground\">\n              {t('shipping_carriers.create.package.label', 'Package')} {index + 1}\n            </span>\n            {packages.length > 1 ? (\n              <Button\n                type=\"button\"\n                variant=\"ghost\"\n                size=\"sm\"\n                className=\"h-auto px-2 py-0.5 text-xs text-destructive hover:text-destructive/80\"\n                onClick={() => removePackage(index)}\n                disabled={disabled}\n              >\n                {t('shipping_carriers.create.package.remove', 'Remove')}\n              </Button>\n            ) : null}\n          </div>\n          <div className=\"grid gap-3 sm:grid-cols-4\">\n            {PACKAGE_FIELDS.map((field) => (\n              <div key={field}>\n                <label className=\"mb-1 block text-xs font-medium text-muted-foreground\">\n                  {fieldLabel(field)}\n                </label>\n                <Input\n                  type=\"number\"\n                  min=\"0.01\"\n                  step=\"0.01\"\n                  value={pkg[field]}\n                  onChange={(event) => updatePackage(index, field, event.target.value)}\n                  disabled={disabled}\n                />\n              </div>\n            ))}\n          </div>\n        </div>\n      ))}\n      <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={addPackage} disabled={disabled}>\n        {t('shipping_carriers.create.package.add', '+ Add package')}\n      </Button>\n    </div>\n  )\n}\n"],
   "mappings": ";AAyCY,SAIE,KAJF;AAvCZ,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,YAAY;AAGrB,MAAM,iBAAiB,CAAC,YAAY,YAAY,WAAW,UAAU;AAErE,MAAM,kBAAoC,EAAE,UAAU,GAAG,UAAU,IAAI,SAAS,IAAI,UAAU,GAAG;AAE1F,MAAM,gBAAgB,CAAC,UAA8B;AAC1D,QAAM,EAAE,UAAU,UAAU,SAAS,IAAI;AACzC,QAAM,IAAI,KAAK;AAEf,QAAM,aAAa,CAAC,UAAkC;AACpD,UAAM,SAAiD;AAAA,MACrD,UAAU,EAAE,6CAA6C,aAAa;AAAA,MACtE,UAAU,EAAE,6CAA6C,aAAa;AAAA,MACtE,SAAS,EAAE,4CAA4C,YAAY;AAAA,MACnE,UAAU,EAAE,6CAA6C,aAAa;AAAA,IACxE;AACA,WAAO,OAAO,KAAK;AAAA,EACrB;AAEA,QAAM,gBAAgB,CAAC,OAAe,OAA+B,QAAgB;AACnF,UAAM,QAAQ,WAAW,GAAG;AAC5B,aAAS,SAAS;AAAA,MAAI,CAAC,KAAK,QAC1B,QAAQ,QAAQ,EAAE,GAAG,KAAK,CAAC,KAAK,GAAG,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI;AAAA,IACzE,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,MAAM,SAAS,CAAC,GAAG,UAAU,eAAe,CAAC;AAEhE,QAAM,gBAAgB,CAAC,UAAkB,SAAS,SAAS,OAAO,CAAC,GAAG,QAAQ,QAAQ,KAAK,CAAC;AAE5F,SACE,qBAAC,SAAI,WAAU,aACZ;AAAA,aAAS,IAAI,CAAC,KAAK,UAClB,qBAAC,SAAgB,WAAU,qCACzB;AAAA,2BAAC,SAAI,WAAU,0CACb;AAAA,6BAAC,UAAK,WAAU,6CACb;AAAA,YAAE,0CAA0C,SAAS;AAAA,UAAE;AAAA,UAAE,QAAQ;AAAA,WACpE;AAAA,QACC,SAAS,SAAS,IACjB;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,cAAc,KAAK;AAAA,YAClC;AAAA,YAEC,YAAE,2CAA2C,QAAQ;AAAA;AAAA,QACxD,IACE;AAAA,SACN;AAAA,MACA,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UACnB,qBAAC,SACC;AAAA,4BAAC,WAAM,WAAU,wDACd,qBAAW,KAAK,GACnB;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,KAAI;AAAA,YACJ,MAAK;AAAA,YACL,OAAO,IAAI,KAAK;AAAA,YAChB,UAAU,CAAC,UAAU,cAAc,OAAO,OAAO,MAAM,OAAO,KAAK;AAAA,YACnE;AAAA;AAAA,QACF;AAAA,WAXQ,KAYV,CACD,GACH;AAAA,SAlCQ,KAmCV,CACD;AAAA,IACD,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,YAAY,UACpE,YAAE,wCAAwC,eAAe,GAC5D;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/staff/api/interceptors.js

@@ -1,7 +1,6 @@
-import { hasFeature } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 import { getStaffMemberByUserId } from "../lib/staffMemberResolver.js";
 async function hasManageAllFeature(context) {
-  if (hasFeature(context.userFeatures, "staff.timesheets.manage_all")) return true;
   try {
     const rbac = context.container.resolve("rbacService");
     if (rbac?.userHasAllFeatures) {
@@ -13,7 +12,10 @@ async function hasManageAllFeature(context) {
     }
   } catch {
   }
-  return false;
+  return authorizeFeatures(
+    ["staff.timesheets.manage_all"],
+    { grantedFeatures: context.userFeatures ?? [] }
+  );
 }
 const interceptors = [
   {

package/dist/modules/staff/api/interceptors.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/api/interceptors.ts"],
-  "sourcesContent": ["import type { ApiInterceptor, InterceptorContext } from '@open-mercato/shared/lib/crud/api-interceptor'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { getStaffMemberByUserId } from '../lib/staffMemberResolver'\n\ntype RbacServiceLike = {\n  userHasAllFeatures: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\n/**\n * Checks whether the caller has manage_all rights, honoring wildcard ACL grants\n * (`staff.*`, `*`) and the super-admin flag.\n *\n * `context.userFeatures` is populated only on CRUD-factory routes (factory.ts\n * calls `rbacService.getGrantedFeatures`). Custom routes that wire interceptors\n * manually (like `dashboards/widgets/data`) pass `auth.features` directly, and\n * the JWT does NOT include features \u2014 so we must fall back to loading the ACL\n * from `rbacService.userHasAllFeatures`, which is cached and wildcard-aware.\n */\nasync function hasManageAllFeature(context: InterceptorContext): Promise<boolean> {\n  if (hasFeature(context.userFeatures, 'staff.timesheets.manage_all')) return true\n  try {\n    const rbac = context.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (rbac?.userHasAllFeatures) {\n      return await rbac.userHasAllFeatures(\n        context.userId,\n        ['staff.timesheets.manage_all'],\n        { tenantId: context.tenantId ?? null, organizationId: context.organizationId ?? null },\n      )\n    }\n  } catch {\n    // rbacService not available \u2014 fall through to deny\n  }\n  return false\n}\n\nexport const interceptors: ApiInterceptor[] = [\n  {\n    id: 'staff.timesheets.self-scope-widget-data',\n    targetRoute: 'dashboards/widgets/data',\n    methods: ['POST'],\n    priority: 70,\n    async before(request, context) {\n      const entityType = request.body?.entityType\n      if (entityType !== 'staff:staff_time_entries') {\n        return { ok: true }\n      }\n\n      if (await hasManageAllFeature(context)) {\n        return { ok: true }\n      }\n\n      const staffMember = await getStaffMemberByUserId(\n        context.em,\n        context.userId,\n        context.tenantId ?? null,\n        context.organizationId ?? null,\n      )\n\n      if (!staffMember) {\n        return {\n          ok: false,\n          statusCode: 403,\n          message: 'User is not a staff member.',\n        }\n      }\n\n      const existingFilters = Array.isArray(request.body?.filters) ? request.body.filters : []\n      const otherFilters = existingFilters.filter(\n        (f: Record<string, unknown>) => f.field !== 'staffMemberId',\n      )\n\n      return {\n        ok: true,\n        body: {\n          ...request.body,\n          filters: [\n            ...otherFilters,\n            { field: 'staffMemberId', operator: 'eq', value: staffMember.id },\n          ],\n        },\n      }\n    },\n  },\n  {\n    id: 'staff.timesheets.self-scope-time-entries',\n    targetRoute: 'staff/timesheets/time-entries',\n    methods: ['GET'],\n    priority: 70,\n    async before(request, context) {\n      if (await hasManageAllFeature(context)) {\n        return { ok: true }\n      }\n\n      const staffMember = await getStaffMemberByUserId(\n        context.em,\n        context.userId,\n        context.tenantId ?? null,\n        context.organizationId ?? null,\n      )\n\n      if (!staffMember) {\n        return {\n          ok: false,\n          statusCode: 403,\n          message: 'User is not a staff member.',\n        }\n      }\n\n      return {\n        ok: true,\n        query: {\n          ...(request.query ?? {}),\n          staffMemberId: staffMember.id,\n        },\n      }\n    },\n  },\n]\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAoBvC,eAAe,oBAAoB,SAA+C;AAChF,MAAI,WAAW,QAAQ,cAAc,6BAA6B,EAAG,QAAO;AAC5E,MAAI;AACF,UAAM,OAAO,QAAQ,UAAU,QAAQ,aAAa;AACpD,QAAI,MAAM,oBAAoB;AAC5B,aAAO,MAAM,KAAK;AAAA,QAChB,QAAQ;AAAA,QACR,CAAC,6BAA6B;AAAA,QAC9B,EAAE,UAAU,QAAQ,YAAY,MAAM,gBAAgB,QAAQ,kBAAkB,KAAK;AAAA,MACvF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEO,MAAM,eAAiC;AAAA,EAC5C;AAAA,IACE,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,SAAS,CAAC,MAAM;AAAA,IAChB,UAAU;AAAA,IACV,MAAM,OAAO,SAAS,SAAS;AAC7B,YAAM,aAAa,QAAQ,MAAM;AACjC,UAAI,eAAe,4BAA4B;AAC7C,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,UAAI,MAAM,oBAAoB,OAAO,GAAG;AACtC,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,YAAM,cAAc,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,YAAY;AAAA,QACpB,QAAQ,kBAAkB;AAAA,MAC5B;AAEA,UAAI,CAAC,aAAa;AAChB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,kBAAkB,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,UAAU,CAAC;AACvF,YAAM,eAAe,gBAAgB;AAAA,QACnC,CAAC,MAA+B,EAAE,UAAU;AAAA,MAC9C;AAEA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,GAAG,QAAQ;AAAA,UACX,SAAS;AAAA,YACP,GAAG;AAAA,YACH,EAAE,OAAO,iBAAiB,UAAU,MAAM,OAAO,YAAY,GAAG;AAAA,UAClE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,SAAS,CAAC,KAAK;AAAA,IACf,UAAU;AAAA,IACV,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI,MAAM,oBAAoB,OAAO,GAAG;AACtC,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,YAAM,cAAc,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,YAAY;AAAA,QACpB,QAAQ,kBAAkB;AAAA,MAC5B;AAEA,UAAI,CAAC,aAAa;AAChB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAEA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,GAAI,QAAQ,SAAS,CAAC;AAAA,UACtB,eAAe,YAAY;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { ApiInterceptor, InterceptorContext } from '@open-mercato/shared/lib/crud/api-interceptor'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { getStaffMemberByUserId } from '../lib/staffMemberResolver'\n\ntype RbacServiceLike = {\n  userHasAllFeatures: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\n/**\n * Checks whether the caller has manage_all rights, honoring wildcard ACL grants\n * (`staff.*`, `*`) and the super-admin flag.\n *\n * `context.userFeatures` is populated only on CRUD-factory routes (factory.ts\n * calls `rbacService.getGrantedFeatures`). Custom routes that wire interceptors\n * manually (like `dashboards/widgets/data`) pass `auth.features` directly, and\n * the JWT does NOT include features \u2014 so we must fall back to loading the ACL\n * from `rbacService.userHasAllFeatures`, which is cached and wildcard-aware.\n */\nasync function hasManageAllFeature(context: InterceptorContext): Promise<boolean> {\n  try {\n    const rbac = context.container.resolve('rbacService') as RbacServiceLike | undefined\n    if (rbac?.userHasAllFeatures) {\n      return await rbac.userHasAllFeatures(\n        context.userId,\n        ['staff.timesheets.manage_all'],\n        { tenantId: context.tenantId ?? null, organizationId: context.organizationId ?? null },\n      )\n    }\n  } catch {\n    // Fall back to the already-loaded snapshot below.\n  }\n  return authorizeFeatures(\n    ['staff.timesheets.manage_all'],\n    { grantedFeatures: context.userFeatures ?? [] },\n  )\n}\n\nexport const interceptors: ApiInterceptor[] = [\n  {\n    id: 'staff.timesheets.self-scope-widget-data',\n    targetRoute: 'dashboards/widgets/data',\n    methods: ['POST'],\n    priority: 70,\n    async before(request, context) {\n      const entityType = request.body?.entityType\n      if (entityType !== 'staff:staff_time_entries') {\n        return { ok: true }\n      }\n\n      if (await hasManageAllFeature(context)) {\n        return { ok: true }\n      }\n\n      const staffMember = await getStaffMemberByUserId(\n        context.em,\n        context.userId,\n        context.tenantId ?? null,\n        context.organizationId ?? null,\n      )\n\n      if (!staffMember) {\n        return {\n          ok: false,\n          statusCode: 403,\n          message: 'User is not a staff member.',\n        }\n      }\n\n      const existingFilters = Array.isArray(request.body?.filters) ? request.body.filters : []\n      const otherFilters = existingFilters.filter(\n        (f: Record<string, unknown>) => f.field !== 'staffMemberId',\n      )\n\n      return {\n        ok: true,\n        body: {\n          ...request.body,\n          filters: [\n            ...otherFilters,\n            { field: 'staffMemberId', operator: 'eq', value: staffMember.id },\n          ],\n        },\n      }\n    },\n  },\n  {\n    id: 'staff.timesheets.self-scope-time-entries',\n    targetRoute: 'staff/timesheets/time-entries',\n    methods: ['GET'],\n    priority: 70,\n    async before(request, context) {\n      if (await hasManageAllFeature(context)) {\n        return { ok: true }\n      }\n\n      const staffMember = await getStaffMemberByUserId(\n        context.em,\n        context.userId,\n        context.tenantId ?? null,\n        context.organizationId ?? null,\n      )\n\n      if (!staffMember) {\n        return {\n          ok: false,\n          statusCode: 403,\n          message: 'User is not a staff member.',\n        }\n      }\n\n      return {\n        ok: true,\n        query: {\n          ...(request.query ?? {}),\n          staffMemberId: staffMember.id,\n        },\n      }\n    },\n  },\n]\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AAClC,SAAS,8BAA8B;AAoBvC,eAAe,oBAAoB,SAA+C;AAChF,MAAI;AACF,UAAM,OAAO,QAAQ,UAAU,QAAQ,aAAa;AACpD,QAAI,MAAM,oBAAoB;AAC5B,aAAO,MAAM,KAAK;AAAA,QAChB,QAAQ;AAAA,QACR,CAAC,6BAA6B;AAAA,QAC9B,EAAE,UAAU,QAAQ,YAAY,MAAM,gBAAgB,QAAQ,kBAAkB,KAAK;AAAA,MACvF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AAAA,IACL,CAAC,6BAA6B;AAAA,IAC9B,EAAE,iBAAiB,QAAQ,gBAAgB,CAAC,EAAE;AAAA,EAChD;AACF;AAEO,MAAM,eAAiC;AAAA,EAC5C;AAAA,IACE,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,SAAS,CAAC,MAAM;AAAA,IAChB,UAAU;AAAA,IACV,MAAM,OAAO,SAAS,SAAS;AAC7B,YAAM,aAAa,QAAQ,MAAM;AACjC,UAAI,eAAe,4BAA4B;AAC7C,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,UAAI,MAAM,oBAAoB,OAAO,GAAG;AACtC,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,YAAM,cAAc,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,YAAY;AAAA,QACpB,QAAQ,kBAAkB;AAAA,MAC5B;AAEA,UAAI,CAAC,aAAa;AAChB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAEA,YAAM,kBAAkB,MAAM,QAAQ,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,UAAU,CAAC;AACvF,YAAM,eAAe,gBAAgB;AAAA,QACnC,CAAC,MAA+B,EAAE,UAAU;AAAA,MAC9C;AAEA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,MAAM;AAAA,UACJ,GAAG,QAAQ;AAAA,UACX,SAAS;AAAA,YACP,GAAG;AAAA,YACH,EAAE,OAAO,iBAAiB,UAAU,MAAM,OAAO,YAAY,GAAG;AAAA,UAClE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,SAAS,CAAC,KAAK;AAAA,IACf,UAAU;AAAA,IACV,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI,MAAM,oBAAoB,OAAO,GAAG;AACtC,eAAO,EAAE,IAAI,KAAK;AAAA,MACpB;AAEA,YAAM,cAAc,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,YAAY;AAAA,QACpB,QAAQ,kBAAkB;AAAA,MAC5B;AAEA,UAAI,CAAC,aAAa;AAChB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,SAAS;AAAA,QACX;AAAA,MACF;AAEA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,UACL,GAAI,QAAQ,SAAS,CAAC;AAAA,UACtB,eAAe,YAAY;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests.js

@@ -18,6 +18,7 @@ const MANAGE_FEATURE = "staff.leave_requests.manage";
 const SEND_FEATURE = "staff.leave_requests.send";
 const MY_VIEW_FEATURE = "staff.my_leave_requests.view";
 const MY_SEND_FEATURE = "staff.my_leave_requests.send";
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
 const routeMetadata = {
   GET: { requireAuth: true },
   POST: { requireAuth: true },
@@ -91,6 +92,48 @@ async function resolveLeaveRequestAccess(ctx) {
   );
   return { canManage, canSend, canView, memberId: member?.id ?? null };
 }
+async function buildLeaveRequestFilters(query, ctx) {
+  const filters = {};
+  if (typeof query.ids === "string" && query.ids.trim().length > 0) {
+    const ids = query.ids.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+    if (ids.length > 0) {
+      filters[F.id] = { $in: ids };
+    }
+  }
+  if (query.status) {
+    filters[F.status] = query.status;
+  }
+  if (query.memberId) {
+    filters[F.member_id] = query.memberId;
+  }
+  const term = sanitizeSearchTerm(query.search);
+  if (term) {
+    const like = `%${escapeLikePattern(term)}%`;
+    const em = ctx.container.resolve("em").fork();
+    const members = await findWithDecryption(
+      em,
+      StaffTeamMember,
+      { displayName: { $ilike: like }, deletedAt: null },
+      { fields: ["id"] },
+      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null }
+    );
+    const memberIds = members.map((member) => member.id);
+    if (!memberIds.length) {
+      filters[F.id] = NIL_UUID;
+    } else {
+      filters[F.member_id] = { $in: memberIds };
+    }
+  }
+  const access = await resolveLeaveRequestAccess(ctx);
+  if (!access.canManage) {
+    if (!access.canView || !access.memberId) {
+      filters[F.id] = NIL_UUID;
+    } else {
+      filters[F.member_id] = access.memberId;
+    }
+  }
+  return filters;
+}
 const crud = makeCrudRoute({
   metadata: routeMetadata,
   orm: {
@@ -129,48 +172,7 @@ const crud = makeCrudRoute({
       createdAt: F.created_at,
       updatedAt: F.updated_at
     },
-    buildFilters: async (query, ctx) => {
-      const filters = {};
-      if (typeof query.ids === "string" && query.ids.trim().length > 0) {
-        const ids = query.ids.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
-        if (ids.length > 0) {
-          filters[F.id] = { $in: ids };
-        }
-      }
-      if (query.status) {
-        filters[F.status] = query.status;
-      }
-      if (query.memberId) {
-        filters[F.member_id] = query.memberId;
-      }
-      const term = sanitizeSearchTerm(query.search);
-      if (term) {
-        const like = `%${escapeLikePattern(term)}%`;
-        const em = ctx.container.resolve("em").fork();
-        const members = await findWithDecryption(
-          em,
-          StaffTeamMember,
-          { displayName: { $ilike: like }, deletedAt: null },
-          { fields: ["id"] },
-          { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null }
-        );
-        const memberIds = members.map((member) => member.id);
-        if (!memberIds.length) {
-          filters[F.id] = "__no_match__";
-        } else {
-          filters[F.member_id] = { $in: memberIds };
-        }
-      }
-      const access = await resolveLeaveRequestAccess(ctx);
-      if (!access.canManage) {
-        if (!access.canView || !access.memberId) {
-          filters[F.id] = "__no_access__";
-        } else {
-          filters[F.member_id] = access.memberId;
-        }
-      }
-      return filters;
-    }
+    buildFilters: buildLeaveRequestFilters
   },
   hooks: {
     afterList: async (payload, ctx) => {
@@ -359,6 +361,7 @@ export {
   GET,
   POST,
   PUT,
+  buildLeaveRequestFilters,
   metadata,
   openApi
 };

package/dist/modules/staff/api/leave-requests.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/api/leave-requests.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffLeaveRequest, StaffTeamMember } from '../data/entities'\nimport {\n  staffLeaveRequestCreateSchema,\n  staffLeaveRequestUpdateSchema,\n  staffLeaveRequestDecisionSchema,\n} from '../data/validators'\nimport { sanitizeSearchTerm } from './helpers'\nimport { E } from '#generated/entities.ids.generated'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from './openapi'\n\nconst MANAGE_FEATURE = 'staff.leave_requests.manage'\nconst SEND_FEATURE = 'staff.leave_requests.send'\nconst MY_VIEW_FEATURE = 'staff.my_leave_requests.view'\nconst MY_SEND_FEATURE = 'staff.my_leave_requests.send'\n\nconst routeMetadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true },\n  PUT: { requireAuth: true },\n  DELETE: { requireAuth: true },\n}\n\nexport const metadata = routeMetadata\n\n// Field constants for StaffLeaveRequest entity\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  member_id: 'member_id',\n  start_date: 'start_date',\n  end_date: 'end_date',\n  timezone: 'timezone',\n  status: 'status',\n  unavailability_reason_entry_id: 'unavailability_reason_entry_id',\n  unavailability_reason_value: 'unavailability_reason_value',\n  note: 'note',\n  decision_comment: 'decision_comment',\n  submitted_by_user_id: 'submitted_by_user_id',\n  decided_by_user_id: 'decided_by_user_id',\n  decided_at: 'decided_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    search: z.string().optional(),\n    status: z.enum(['pending', 'approved', 'rejected']).optional(),\n    memberId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype LeaveRequestAccess = {\n  canManage: boolean\n  canSend: boolean\n  canView: boolean\n  memberId: string | null\n}\n\nconst uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nfunction resolveActorUserId(ctx: { auth?: { sub?: string | null; isApiKey?: boolean } | null }): string | null {\n  if (!ctx.auth || ctx.auth.isApiKey) return null\n  const sub = ctx.auth.sub ?? null\n  if (!sub || !uuidRegex.test(sub)) return null\n  return sub\n}\n\nasync function resolveLeaveRequestAccess(ctx: any): Promise<LeaveRequestAccess> {\n  const auth = ctx.auth\n  if (!auth || !auth.sub || auth.isApiKey) {\n    return { canManage: false, canSend: false, canView: false, memberId: null }\n  }\n  const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.organizationScope?.selectedId ?? auth.orgId ?? null\n  const rbac = (ctx.container.resolve('rbacService') as RbacService)\n  const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([\n    rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_VIEW_FEATURE], { tenantId, organizationId }),\n  ])\n  const canSend = canSendLegacy || canSendSelf\n  const canView = canManage || canSend || canViewSelf\n  if (!canManage && !canView) {\n    return { canManage, canSend, canView, memberId: null }\n  }\n  const member = await findOneWithDecryption(\n    ctx.container.resolve('em') as EntityManager,\n    StaffTeamMember,\n    { userId: auth.sub, deletedAt: null },\n    undefined,\n    { tenantId, organizationId },\n  )\n  return { canManage, canSend, canView, memberId: member?.id ?? null }\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffLeaveRequest,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.staff.staff_leave_request },\n  list: {\n    schema: listSchema,\n    entityId: E.staff.staff_leave_request,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.member_id,\n      F.start_date,\n      F.end_date,\n      F.timezone,\n      F.status,\n      F.unavailability_reason_entry_id,\n      F.unavailability_reason_value,\n      F.note,\n      F.decision_comment,\n      F.submitted_by_user_id,\n      F.decided_by_user_id,\n      F.decided_at,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      startDate: F.start_date,\n      endDate: F.end_date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: async (query, ctx) => {\n      const filters: Record<string, unknown> = {}\n      if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n        const ids = query.ids\n          .split(',')\n          .map((value) => value.trim())\n          .filter((value) => value.length > 0)\n        if (ids.length > 0) {\n          filters[F.id] = { $in: ids }\n        }\n      }\n      if (query.status) {\n        filters[F.status] = query.status\n      }\n      if (query.memberId) {\n        filters[F.member_id] = query.memberId\n      }\n      const term = sanitizeSearchTerm(query.search)\n      if (term) {\n        const like = `%${escapeLikePattern(term)}%`\n        const em = (ctx.container.resolve('em') as EntityManager).fork()\n        const members = await findWithDecryption(\n          em,\n          StaffTeamMember,\n          { displayName: { $ilike: like }, deletedAt: null },\n          { fields: ['id'] },\n          { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n        )\n        const memberIds = members.map((member) => member.id)\n        if (!memberIds.length) {\n          filters[F.id] = '__no_match__'\n        } else {\n          filters[F.member_id] = { $in: memberIds }\n        }\n      }\n\n      const access = await resolveLeaveRequestAccess(ctx)\n      if (!access.canManage) {\n        if (!access.canView || !access.memberId) {\n          filters[F.id] = '__no_access__'\n        } else {\n          filters[F.member_id] = access.memberId\n        }\n      }\n      return filters\n    },\n  },\n  hooks: {\n    afterList: async (payload, ctx) => {\n      const items: Array<Record<string, unknown>> = Array.isArray(payload?.items)\n        ? (payload.items as Array<Record<string, unknown>>)\n        : []\n      if (!items.length) {\n        payload.viewer = await resolveLeaveRequestAccess(ctx)\n        return\n      }\n      const memberIds = new Set<string>()\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (memberId) memberIds.add(memberId)\n      })\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const members = memberIds.size\n        ? await findWithDecryption(\n            em,\n            StaffTeamMember,\n            { id: { $in: Array.from(memberIds) } },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n        : []\n      const memberById = new Map(members.map((member) => [member.id, member]))\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (!memberId) return\n        const member = memberById.get(memberId)\n        if (!member) return\n        item.member = {\n          id: member.id,\n          displayName: member.displayName,\n          userId: member.userId ?? null,\n        }\n      })\n      payload.viewer = await resolveLeaveRequestAccess(ctx)\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.leave-requests.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        const payload = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>) } : {}\n        const actorUserId = resolveActorUserId(ctx)\n        if (actorUserId) payload.submittedByUserId = actorUserId\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(400, { error: translate('staff.leaveRequests.errors.profileRequired', 'Create your profile first.') })\n          }\n          payload.memberId = access.memberId\n        }\n        return parseScopedCommandInput(staffLeaveRequestCreateSchema, payload, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.requestId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.leave-requests.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(staffLeaveRequestUpdateSchema, raw ?? {}, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id: parsed.id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          if (parsed.memberId && parsed.memberId !== memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.leave-requests.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst leaveRequestListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  member_id: z.string().uuid().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  end_date: z.string().nullable().optional(),\n  timezone: z.string().nullable().optional(),\n  status: z.enum(['pending', 'approved', 'rejected']).nullable().optional(),\n  unavailability_reason_entry_id: z.string().uuid().nullable().optional(),\n  unavailability_reason_value: z.string().nullable().optional(),\n  note: z.string().nullable().optional(),\n  decision_comment: z.string().nullable().optional(),\n  submitted_by_user_id: z.string().uuid().nullable().optional(),\n  decided_by_user_id: z.string().uuid().nullable().optional(),\n  decided_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  member: z\n    .object({\n      id: z.string().uuid().nullable().optional(),\n      displayName: z.string().nullable().optional(),\n      userId: z.string().uuid().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst leaveRequestListResponseSchema = createPagedListResponseSchema(leaveRequestListItemSchema).extend({\n  viewer: z\n    .object({\n      canManage: z.boolean(),\n      canSend: z.boolean(),\n      canView: z.boolean(),\n      memberId: z.string().uuid().nullable(),\n    })\n    .optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'Leave request',\n  pluralName: 'Leave requests',\n  querySchema: listSchema,\n  listResponseSchema: leaveRequestListResponseSchema,\n  create: {\n    schema: staffLeaveRequestCreateSchema,\n    description: 'Creates a leave request for a staff member.',\n  },\n  update: {\n    schema: staffLeaveRequestUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a leave request by id.',\n  },\n  del: {\n    schema: staffLeaveRequestDecisionSchema.pick({ id: true }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a leave request by id.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,mBAAmB,uBAAuB;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,iBAAiB;AACvB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,KAAK;AAAA,EAC1B,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,QAAQ,EAAE,aAAa,KAAK;AAC9B;AAEO,MAAM,WAAW;AAGxB,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,gCAAgC;AAAA,EAChC,6BAA6B;AAAA,EAC7B,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AASf,MAAM,YAAY;AAElB,SAAS,mBAAmB,KAAmF;AAC7G,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,SAAU,QAAO;AAC3C,QAAM,MAAM,IAAI,KAAK,OAAO;AAC5B,MAAI,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,EAAG,QAAO;AACzC,SAAO;AACT;AAEA,eAAe,0BAA0B,KAAuC;AAC9E,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,KAAK,UAAU;AACvC,WAAO,EAAE,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,UAAU,KAAK;AAAA,EAC5E;AACA,QAAM,WAAW,IAAI,mBAAmB,YAAY,KAAK,YAAY;AACrE,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,mBAAmB,cAAc,KAAK,SAAS;AACxG,QAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,QAAM,CAAC,WAAW,eAAe,aAAa,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7E,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAChF,KAAK,mBAAmB,KAAK,KAAK,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC9E,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IACjF,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EACnF,CAAC;AACD,QAAM,UAAU,iBAAiB;AACjC,QAAM,UAAU,aAAa,WAAW;AACxC,MAAI,CAAC,aAAa,CAAC,SAAS;AAC1B,WAAO,EAAE,WAAW,SAAS,SAAS,UAAU,KAAK;AAAA,EACvD;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAU,QAAQ,MAAM,KAAK;AACrE;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,MAAM;AAAA,IAClB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc,OAAO,OAAO,QAAQ;AAClC,YAAM,UAAmC,CAAC;AAC1C,UAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,cAAM,MAAM,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,YAAI,IAAI,SAAS,GAAG;AAClB,kBAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI;AAAA,QAC7B;AAAA,MACF;AACA,UAAI,MAAM,QAAQ;AAChB,gBAAQ,EAAE,MAAM,IAAI,MAAM;AAAA,MAC5B;AACA,UAAI,MAAM,UAAU;AAClB,gBAAQ,EAAE,SAAS,IAAI,MAAM;AAAA,MAC/B;AACA,YAAM,OAAO,mBAAmB,MAAM,MAAM;AAC5C,UAAI,MAAM;AACR,cAAM,OAAO,IAAI,kBAAkB,IAAI,CAAC;AACxC,cAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,UACA;AAAA,UACA,EAAE,aAAa,EAAE,QAAQ,KAAK,GAAG,WAAW,KAAK;AAAA,UACjD,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,UACjB,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,QAC7F;AACA,cAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE;AACnD,YAAI,CAAC,UAAU,QAAQ;AACrB,kBAAQ,EAAE,EAAE,IAAI;AAAA,QAClB,OAAO;AACL,kBAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,UAAU;AAAA,QAC1C;AAAA,MACF;AAEA,YAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,UAAI,CAAC,OAAO,WAAW;AACrB,YAAI,CAAC,OAAO,WAAW,CAAC,OAAO,UAAU;AACvC,kBAAQ,EAAE,EAAE,IAAI;AAAA,QAClB,OAAO;AACL,kBAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,QAChC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,SAAS,QAAQ;AACjC,YAAM,QAAwC,MAAM,QAAQ,SAAS,KAAK,IACrE,QAAQ,QACT,CAAC;AACL,UAAI,CAAC,MAAM,QAAQ;AACjB,gBAAQ,SAAS,MAAM,0BAA0B,GAAG;AACpD;AAAA,MACF;AACA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,SAAU,WAAU,IAAI,QAAQ;AAAA,MACtC,CAAC;AACD,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,YAAM,UAAU,UAAU,OACtB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE;AAAA,QACrC;AAAA,QACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,MAC7F,IACA,CAAC;AACL,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AACvE,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,YAAI,CAAC,OAAQ;AACb,aAAK,SAAS;AAAA,UACZ,IAAI,OAAO;AAAA,UACX,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AACD,cAAQ,SAAS,MAAM,0BAA0B,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,cAAM,UAAU,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,IAAgC,IAAI,CAAC;AAC5F,cAAM,cAAc,mBAAmB,GAAG;AAC1C,YAAI,YAAa,SAAQ,oBAAoB;AAC7C,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8CAA8C,4BAA4B,EAAE,CAAC;AAAA,UAC/H;AACA,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,eAAO,wBAAwB,+BAA+B,SAAS,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,aAAa,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,+BAA+B,OAAO,CAAC,GAAG,KAAK,SAAS;AAC/F,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,YACjC;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,cAAI,OAAO,YAAY,OAAO,aAAa,UAAU;AACnD,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,WAAW,KAAK;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,8BAA8B,0BAA0B,EAAE,OAAO;AAAA,EACtG,QAAQ,EACL,OAAO;AAAA,IACN,WAAW,EAAE,QAAQ;AAAA,IACrB,SAAS,EAAE,QAAQ;AAAA,IACnB,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS;AACd,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,gCAAgC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACzD,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffLeaveRequest, StaffTeamMember } from '../data/entities'\nimport {\n  staffLeaveRequestCreateSchema,\n  staffLeaveRequestUpdateSchema,\n  staffLeaveRequestDecisionSchema,\n} from '../data/validators'\nimport { sanitizeSearchTerm } from './helpers'\nimport { E } from '#generated/entities.ids.generated'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from './openapi'\n\nconst MANAGE_FEATURE = 'staff.leave_requests.manage'\nconst SEND_FEATURE = 'staff.leave_requests.send'\nconst MY_VIEW_FEATURE = 'staff.my_leave_requests.view'\nconst MY_SEND_FEATURE = 'staff.my_leave_requests.send'\n\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\n\nconst routeMetadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true },\n  PUT: { requireAuth: true },\n  DELETE: { requireAuth: true },\n}\n\nexport const metadata = routeMetadata\n\n// Field constants for StaffLeaveRequest entity\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  member_id: 'member_id',\n  start_date: 'start_date',\n  end_date: 'end_date',\n  timezone: 'timezone',\n  status: 'status',\n  unavailability_reason_entry_id: 'unavailability_reason_entry_id',\n  unavailability_reason_value: 'unavailability_reason_value',\n  note: 'note',\n  decision_comment: 'decision_comment',\n  submitted_by_user_id: 'submitted_by_user_id',\n  decided_by_user_id: 'decided_by_user_id',\n  decided_at: 'decided_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    search: z.string().optional(),\n    status: z.enum(['pending', 'approved', 'rejected']).optional(),\n    memberId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype LeaveRequestAccess = {\n  canManage: boolean\n  canSend: boolean\n  canView: boolean\n  memberId: string | null\n}\n\nconst uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nfunction resolveActorUserId(ctx: { auth?: { sub?: string | null; isApiKey?: boolean } | null }): string | null {\n  if (!ctx.auth || ctx.auth.isApiKey) return null\n  const sub = ctx.auth.sub ?? null\n  if (!sub || !uuidRegex.test(sub)) return null\n  return sub\n}\n\nasync function resolveLeaveRequestAccess(ctx: any): Promise<LeaveRequestAccess> {\n  const auth = ctx.auth\n  if (!auth || !auth.sub || auth.isApiKey) {\n    return { canManage: false, canSend: false, canView: false, memberId: null }\n  }\n  const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.organizationScope?.selectedId ?? auth.orgId ?? null\n  const rbac = (ctx.container.resolve('rbacService') as RbacService)\n  const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([\n    rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_VIEW_FEATURE], { tenantId, organizationId }),\n  ])\n  const canSend = canSendLegacy || canSendSelf\n  const canView = canManage || canSend || canViewSelf\n  if (!canManage && !canView) {\n    return { canManage, canSend, canView, memberId: null }\n  }\n  const member = await findOneWithDecryption(\n    ctx.container.resolve('em') as EntityManager,\n    StaffTeamMember,\n    { userId: auth.sub, deletedAt: null },\n    undefined,\n    { tenantId, organizationId },\n  )\n  return { canManage, canSend, canView, memberId: member?.id ?? null }\n}\n\nexport async function buildLeaveRequestFilters(\n  query: z.infer<typeof listSchema>,\n  ctx: CrudCtx,\n) {\n  const filters: Record<string, unknown> = {}\n  if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n    const ids = query.ids\n      .split(',')\n      .map((value) => value.trim())\n      .filter((value) => value.length > 0)\n    if (ids.length > 0) {\n      filters[F.id] = { $in: ids }\n    }\n  }\n  if (query.status) {\n    filters[F.status] = query.status\n  }\n  if (query.memberId) {\n    filters[F.member_id] = query.memberId\n  }\n  const term = sanitizeSearchTerm(query.search)\n  if (term) {\n    const like = `%${escapeLikePattern(term)}%`\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      { displayName: { $ilike: like }, deletedAt: null },\n      { fields: ['id'] },\n      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    const memberIds = members.map((member) => member.id)\n    if (!memberIds.length) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = { $in: memberIds }\n    }\n  }\n\n  const access = await resolveLeaveRequestAccess(ctx)\n  if (!access.canManage) {\n    if (!access.canView || !access.memberId) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = access.memberId\n    }\n  }\n  return filters\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffLeaveRequest,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.staff.staff_leave_request },\n  list: {\n    schema: listSchema,\n    entityId: E.staff.staff_leave_request,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.member_id,\n      F.start_date,\n      F.end_date,\n      F.timezone,\n      F.status,\n      F.unavailability_reason_entry_id,\n      F.unavailability_reason_value,\n      F.note,\n      F.decision_comment,\n      F.submitted_by_user_id,\n      F.decided_by_user_id,\n      F.decided_at,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      startDate: F.start_date,\n      endDate: F.end_date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: buildLeaveRequestFilters,\n  },\n  hooks: {\n    afterList: async (payload, ctx) => {\n      const items: Array<Record<string, unknown>> = Array.isArray(payload?.items)\n        ? (payload.items as Array<Record<string, unknown>>)\n        : []\n      if (!items.length) {\n        payload.viewer = await resolveLeaveRequestAccess(ctx)\n        return\n      }\n      const memberIds = new Set<string>()\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (memberId) memberIds.add(memberId)\n      })\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const members = memberIds.size\n        ? await findWithDecryption(\n            em,\n            StaffTeamMember,\n            { id: { $in: Array.from(memberIds) } },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n        : []\n      const memberById = new Map(members.map((member) => [member.id, member]))\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (!memberId) return\n        const member = memberById.get(memberId)\n        if (!member) return\n        item.member = {\n          id: member.id,\n          displayName: member.displayName,\n          userId: member.userId ?? null,\n        }\n      })\n      payload.viewer = await resolveLeaveRequestAccess(ctx)\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.leave-requests.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        const payload = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>) } : {}\n        const actorUserId = resolveActorUserId(ctx)\n        if (actorUserId) payload.submittedByUserId = actorUserId\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(400, { error: translate('staff.leaveRequests.errors.profileRequired', 'Create your profile first.') })\n          }\n          payload.memberId = access.memberId\n        }\n        return parseScopedCommandInput(staffLeaveRequestCreateSchema, payload, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.requestId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.leave-requests.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(staffLeaveRequestUpdateSchema, raw ?? {}, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id: parsed.id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          if (parsed.memberId && parsed.memberId !== memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.leave-requests.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst leaveRequestListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  member_id: z.string().uuid().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  end_date: z.string().nullable().optional(),\n  timezone: z.string().nullable().optional(),\n  status: z.enum(['pending', 'approved', 'rejected']).nullable().optional(),\n  unavailability_reason_entry_id: z.string().uuid().nullable().optional(),\n  unavailability_reason_value: z.string().nullable().optional(),\n  note: z.string().nullable().optional(),\n  decision_comment: z.string().nullable().optional(),\n  submitted_by_user_id: z.string().uuid().nullable().optional(),\n  decided_by_user_id: z.string().uuid().nullable().optional(),\n  decided_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  member: z\n    .object({\n      id: z.string().uuid().nullable().optional(),\n      displayName: z.string().nullable().optional(),\n      userId: z.string().uuid().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst leaveRequestListResponseSchema = createPagedListResponseSchema(leaveRequestListItemSchema).extend({\n  viewer: z\n    .object({\n      canManage: z.boolean(),\n      canSend: z.boolean(),\n      canView: z.boolean(),\n      memberId: z.string().uuid().nullable(),\n    })\n    .optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'Leave request',\n  pluralName: 'Leave requests',\n  querySchema: listSchema,\n  listResponseSchema: leaveRequestListResponseSchema,\n  create: {\n    schema: staffLeaveRequestCreateSchema,\n    description: 'Creates a leave request for a staff member.',\n  },\n  update: {\n    schema: staffLeaveRequestUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a leave request by id.',\n  },\n  del: {\n    schema: staffLeaveRequestDecisionSchema.pick({ id: true }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a leave request by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,mBAAmB,uBAAuB;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,iBAAiB;AACvB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,WAAW;AAEjB,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,KAAK;AAAA,EAC1B,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,QAAQ,EAAE,aAAa,KAAK;AAC9B;AAEO,MAAM,WAAW;AAGxB,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,gCAAgC;AAAA,EAChC,6BAA6B;AAAA,EAC7B,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AASf,MAAM,YAAY;AAElB,SAAS,mBAAmB,KAAmF;AAC7G,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,SAAU,QAAO;AAC3C,QAAM,MAAM,IAAI,KAAK,OAAO;AAC5B,MAAI,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,EAAG,QAAO;AACzC,SAAO;AACT;AAEA,eAAe,0BAA0B,KAAuC;AAC9E,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,KAAK,UAAU;AACvC,WAAO,EAAE,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,UAAU,KAAK;AAAA,EAC5E;AACA,QAAM,WAAW,IAAI,mBAAmB,YAAY,KAAK,YAAY;AACrE,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,mBAAmB,cAAc,KAAK,SAAS;AACxG,QAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,QAAM,CAAC,WAAW,eAAe,aAAa,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7E,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAChF,KAAK,mBAAmB,KAAK,KAAK,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC9E,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IACjF,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EACnF,CAAC;AACD,QAAM,UAAU,iBAAiB;AACjC,QAAM,UAAU,aAAa,WAAW;AACxC,MAAI,CAAC,aAAa,CAAC,SAAS;AAC1B,WAAO,EAAE,WAAW,SAAS,SAAS,UAAU,KAAK;AAAA,EACvD;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAU,QAAQ,MAAM,KAAK;AACrE;AAEA,eAAsB,yBACpB,OACA,KACA;AACA,QAAM,UAAmC,CAAC;AAC1C,MAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,UAAM,MAAM,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAI,IAAI,SAAS,GAAG;AAClB,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,QAAQ;AAChB,YAAQ,EAAE,MAAM,IAAI,MAAM;AAAA,EAC5B;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,EAAE,SAAS,IAAI,MAAM;AAAA,EAC/B;AACA,QAAM,OAAO,mBAAmB,MAAM,MAAM;AAC5C,MAAI,MAAM;AACR,UAAM,OAAO,IAAI,kBAAkB,IAAI,CAAC;AACxC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,aAAa,EAAE,QAAQ,KAAK,GAAG,WAAW,KAAK;AAAA,MACjD,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,MACjB,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IAC7F;AACA,UAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE;AACnD,QAAI,CAAC,UAAU,QAAQ;AACrB,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,UAAU;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,MAAI,CAAC,OAAO,WAAW;AACrB,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,UAAU;AACvC,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,MAAM;AAAA,IAClB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,SAAS,QAAQ;AACjC,YAAM,QAAwC,MAAM,QAAQ,SAAS,KAAK,IACrE,QAAQ,QACT,CAAC;AACL,UAAI,CAAC,MAAM,QAAQ;AACjB,gBAAQ,SAAS,MAAM,0BAA0B,GAAG;AACpD;AAAA,MACF;AACA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,SAAU,WAAU,IAAI,QAAQ;AAAA,MACtC,CAAC;AACD,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,YAAM,UAAU,UAAU,OACtB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE;AAAA,QACrC;AAAA,QACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,MAC7F,IACA,CAAC;AACL,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AACvE,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,YAAI,CAAC,OAAQ;AACb,aAAK,SAAS;AAAA,UACZ,IAAI,OAAO;AAAA,UACX,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AACD,cAAQ,SAAS,MAAM,0BAA0B,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,cAAM,UAAU,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,IAAgC,IAAI,CAAC;AAC5F,cAAM,cAAc,mBAAmB,GAAG;AAC1C,YAAI,YAAa,SAAQ,oBAAoB;AAC7C,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8CAA8C,4BAA4B,EAAE,CAAC;AAAA,UAC/H;AACA,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,eAAO,wBAAwB,+BAA+B,SAAS,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,aAAa,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,+BAA+B,OAAO,CAAC,GAAG,KAAK,SAAS;AAC/F,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,YACjC;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,cAAI,OAAO,YAAY,OAAO,aAAa,UAAU;AACnD,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,WAAW,KAAK;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,8BAA8B,0BAA0B,EAAE,OAAO;AAAA,EACtG,QAAQ,EACL,OAAO;AAAA,IACN,WAAW,EAAE,QAAQ;AAAA,IACrB,SAAS,EAAE,QAAQ;AAAA,IACnB,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS;AACd,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,gCAAgC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACzD,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/components/detail/dictionaries.js

@@ -1,5 +1,6 @@
 "use client";
 import { apiCall, apiCallOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { fetchAllDictionaryEntries } from "@open-mercato/core/modules/dictionaries/lib/fetchAllEntries";
 const STAFF_DICTIONARY_KEYS = {
   activityTypes: "staff-activity-types",
   addressTypes: "staff-address-types"
@@ -31,10 +32,9 @@ async function loadStaffDictionary(kind) {
   const name = kind === "activityTypes" ? "Staff activity types" : "Staff address types";
   const dictionary = await ensureDictionary(key, name);
   if (!dictionary) return { dictionary: null, entries: [] };
-  const entriesCall = await apiCall(`/api/dictionaries/${dictionary.id}/entries`);
+  const entriesCall = await fetchAllDictionaryEntries(dictionary.id);
   if (!entriesCall.ok) return { dictionary, entries: [] };
-  const items = Array.isArray(entriesCall.result?.items) ? entriesCall.result?.items ?? [] : [];
-  const entries = items.map((entry) => {
+  const entries = entriesCall.items.map((entry) => {
     if (!entry || typeof entry !== "object") return null;
     const record = entry;
     const value = typeof record.value === "string" ? record.value : null;

package/dist/modules/staff/components/detail/dictionaries.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/staff/components/detail/dictionaries.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type DictionaryEntryOption = {\n  value: string\n  label: string\n  color: string | null\n  icon: string | null\n}\n\ntype DictionarySummary = {\n  id: string\n  key: string\n  name: string\n}\n\nconst STAFF_DICTIONARY_KEYS = {\n  activityTypes: 'staff-activity-types',\n  addressTypes: 'staff-address-types',\n} as const\n\nasync function ensureDictionary(key: string, name: string): Promise<DictionarySummary | null> {\n  const listCall = await apiCall<{ items?: DictionarySummary[] }>('/api/dictionaries')\n  const items = Array.isArray(listCall.result?.items) ? listCall.result?.items ?? [] : []\n  const existing = items.find((item) => item && item.key === key)\n  if (existing) return existing\n  if (!listCall.ok) return null\n  const created = await apiCallOrThrow<DictionarySummary>(\n    '/api/dictionaries',\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ key, name }),\n    },\n  )\n  const result = created.result as DictionarySummary | undefined\n  if (result && result.id && result.key) return result\n  return null\n}\n\nexport async function loadStaffDictionaryEntries(kind: keyof typeof STAFF_DICTIONARY_KEYS): Promise<DictionaryEntryOption[]> {\n  const { entries } = await loadStaffDictionary(kind)\n  return entries\n}\n\nexport async function loadStaffDictionary(\n  kind: keyof typeof STAFF_DICTIONARY_KEYS,\n): Promise<{ dictionary: DictionarySummary | null; entries: DictionaryEntryOption[] }> {\n  const key = STAFF_DICTIONARY_KEYS[kind]\n  const name = kind === 'activityTypes' ? 'Staff activity types' : 'Staff address types'\n  const dictionary = await ensureDictionary(key, name)\n  if (!dictionary) return { dictionary: null, entries: [] }\n  const entriesCall = await apiCall<{ items?: Record<string, unknown>[] }>(`/api/dictionaries/${dictionary.id}/entries`)\n  if (!entriesCall.ok) return { dictionary, entries: [] }\n  const items = Array.isArray(entriesCall.result?.items) ? entriesCall.result?.items ?? [] : []\n  const entries = items\n    .map((entry) => {\n      if (!entry || typeof entry !== 'object') return null\n      const record = entry as Record<string, unknown>\n      const value = typeof record.value === 'string' ? record.value : null\n      if (!value) return null\n      const label = typeof record.label === 'string' && record.label.trim().length ? record.label : value\n      const color = typeof record.color === 'string' ? record.color : null\n      const icon = typeof record.icon === 'string' ? record.icon : null\n      return { value, label, color, icon }\n    })\n    .filter((entry): entry is DictionaryEntryOption => !!entry)\n  return { dictionary, entries }\n}\n\nexport async function createStaffDictionaryEntry(\n  kind: keyof typeof STAFF_DICTIONARY_KEYS,\n  input: { value: string; label?: string; color?: string | null; icon?: string | null },\n): Promise<DictionaryEntryOption | null> {\n  const key = STAFF_DICTIONARY_KEYS[kind]\n  const name = kind === 'activityTypes' ? 'Staff activity types' : 'Staff address types'\n  const dictionary = await ensureDictionary(key, name)\n  if (!dictionary) return null\n  const response = await apiCallOrThrow<Record<string, unknown>>(\n    `/api/dictionaries/${dictionary.id}/entries`,\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        value: input.value,\n        label: input.label ?? undefined,\n        color: input.color ?? undefined,\n        icon: input.icon ?? undefined,\n      }),\n    },\n  )\n  const payload = response.result ?? {}\n  const value = typeof payload.value === 'string' && payload.value.trim().length ? payload.value : input.value\n  const label = typeof payload.label === 'string' && payload.label.trim().length ? payload.label : value\n  const color = typeof payload.color === 'string' ? payload.color : input.color ?? null\n  const icon = typeof payload.icon === 'string' ? payload.icon : input.icon ?? null\n  return { value, label, color, icon }\n}\n"],
-  "mappings": ";AAEA,SAAS,SAAS,sBAAsB;AAexC,MAAM,wBAAwB;AAAA,EAC5B,eAAe;AAAA,EACf,cAAc;AAChB;AAEA,eAAe,iBAAiB,KAAa,MAAiD;AAC5F,QAAM,WAAW,MAAM,QAAyC,mBAAmB;AACnF,QAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,KAAK,IAAI,SAAS,QAAQ,SAAS,CAAC,IAAI,CAAC;AACtF,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,QAAQ,KAAK,QAAQ,GAAG;AAC9D,MAAI,SAAU,QAAO;AACrB,MAAI,CAAC,SAAS,GAAI,QAAO;AACzB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAS,QAAQ;AACvB,MAAI,UAAU,OAAO,MAAM,OAAO,IAAK,QAAO;AAC9C,SAAO;AACT;AAEA,eAAsB,2BAA2B,MAA4E;AAC3H,QAAM,EAAE,QAAQ,IAAI,MAAM,oBAAoB,IAAI;AAClD,SAAO;AACT;AAEA,eAAsB,oBACpB,MACqF;AACrF,QAAM,MAAM,sBAAsB,IAAI;AACtC,QAAM,OAAO,SAAS,kBAAkB,yBAAyB;AACjE,QAAM,aAAa,MAAM,iBAAiB,KAAK,IAAI;AACnD,MAAI,CAAC,WAAY,QAAO,EAAE,YAAY,MAAM,SAAS,CAAC,EAAE;AACxD,QAAM,cAAc,MAAM,QAA+C,qBAAqB,WAAW,EAAE,UAAU;AACrH,MAAI,CAAC,YAAY,GAAI,QAAO,EAAE,YAAY,SAAS,CAAC,EAAE;AACtD,QAAM,QAAQ,MAAM,QAAQ,YAAY,QAAQ,KAAK,IAAI,YAAY,QAAQ,SAAS,CAAC,IAAI,CAAC;AAC5F,QAAM,UAAU,MACb,IAAI,CAAC,UAAU;AACd,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,SAAS;AACf,UAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,SAAS,OAAO,QAAQ;AAC9F,UAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,WAAO,EAAE,OAAO,OAAO,OAAO,KAAK;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,UAA0C,CAAC,CAAC,KAAK;AAC5D,SAAO,EAAE,YAAY,QAAQ;AAC/B;AAEA,eAAsB,2BACpB,MACA,OACuC;AACvC,QAAM,MAAM,sBAAsB,IAAI;AACtC,QAAM,OAAO,SAAS,kBAAkB,yBAAyB;AACjE,QAAM,aAAa,MAAM,iBAAiB,KAAK,IAAI;AACnD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,WAAW,MAAM;AAAA,IACrB,qBAAqB,WAAW,EAAE;AAAA,IAClC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,OAAO,MAAM,SAAS;AAAA,QACtB,OAAO,MAAM,SAAS;AAAA,QACtB,MAAM,MAAM,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,SAAS,UAAU,CAAC;AACpC,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,EAAE,SAAS,QAAQ,QAAQ,MAAM;AACvG,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,EAAE,SAAS,QAAQ,QAAQ;AACjG,QAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,MAAM,SAAS;AACjF,QAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,MAAM,QAAQ;AAC7E,SAAO,EAAE,OAAO,OAAO,OAAO,KAAK;AACrC;",
+  "sourcesContent": ["\"use client\"\n\nimport { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { fetchAllDictionaryEntries } from '@open-mercato/core/modules/dictionaries/lib/fetchAllEntries'\n\nexport type DictionaryEntryOption = {\n  value: string\n  label: string\n  color: string | null\n  icon: string | null\n}\n\ntype DictionarySummary = {\n  id: string\n  key: string\n  name: string\n}\n\nconst STAFF_DICTIONARY_KEYS = {\n  activityTypes: 'staff-activity-types',\n  addressTypes: 'staff-address-types',\n} as const\n\nasync function ensureDictionary(key: string, name: string): Promise<DictionarySummary | null> {\n  const listCall = await apiCall<{ items?: DictionarySummary[] }>('/api/dictionaries')\n  const items = Array.isArray(listCall.result?.items) ? listCall.result?.items ?? [] : []\n  const existing = items.find((item) => item && item.key === key)\n  if (existing) return existing\n  if (!listCall.ok) return null\n  const created = await apiCallOrThrow<DictionarySummary>(\n    '/api/dictionaries',\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ key, name }),\n    },\n  )\n  const result = created.result as DictionarySummary | undefined\n  if (result && result.id && result.key) return result\n  return null\n}\n\nexport async function loadStaffDictionaryEntries(kind: keyof typeof STAFF_DICTIONARY_KEYS): Promise<DictionaryEntryOption[]> {\n  const { entries } = await loadStaffDictionary(kind)\n  return entries\n}\n\nexport async function loadStaffDictionary(\n  kind: keyof typeof STAFF_DICTIONARY_KEYS,\n): Promise<{ dictionary: DictionarySummary | null; entries: DictionaryEntryOption[] }> {\n  const key = STAFF_DICTIONARY_KEYS[kind]\n  const name = kind === 'activityTypes' ? 'Staff activity types' : 'Staff address types'\n  const dictionary = await ensureDictionary(key, name)\n  if (!dictionary) return { dictionary: null, entries: [] }\n  const entriesCall = await fetchAllDictionaryEntries(dictionary.id)\n  if (!entriesCall.ok) return { dictionary, entries: [] }\n  const entries = entriesCall.items\n    .map((entry) => {\n      if (!entry || typeof entry !== 'object') return null\n      const record = entry as Record<string, unknown>\n      const value = typeof record.value === 'string' ? record.value : null\n      if (!value) return null\n      const label = typeof record.label === 'string' && record.label.trim().length ? record.label : value\n      const color = typeof record.color === 'string' ? record.color : null\n      const icon = typeof record.icon === 'string' ? record.icon : null\n      return { value, label, color, icon }\n    })\n    .filter((entry): entry is DictionaryEntryOption => !!entry)\n  return { dictionary, entries }\n}\n\nexport async function createStaffDictionaryEntry(\n  kind: keyof typeof STAFF_DICTIONARY_KEYS,\n  input: { value: string; label?: string; color?: string | null; icon?: string | null },\n): Promise<DictionaryEntryOption | null> {\n  const key = STAFF_DICTIONARY_KEYS[kind]\n  const name = kind === 'activityTypes' ? 'Staff activity types' : 'Staff address types'\n  const dictionary = await ensureDictionary(key, name)\n  if (!dictionary) return null\n  const response = await apiCallOrThrow<Record<string, unknown>>(\n    `/api/dictionaries/${dictionary.id}/entries`,\n    {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        value: input.value,\n        label: input.label ?? undefined,\n        color: input.color ?? undefined,\n        icon: input.icon ?? undefined,\n      }),\n    },\n  )\n  const payload = response.result ?? {}\n  const value = typeof payload.value === 'string' && payload.value.trim().length ? payload.value : input.value\n  const label = typeof payload.label === 'string' && payload.label.trim().length ? payload.label : value\n  const color = typeof payload.color === 'string' ? payload.color : input.color ?? null\n  const icon = typeof payload.icon === 'string' ? payload.icon : input.icon ?? null\n  return { value, label, color, icon }\n}\n"],
+  "mappings": ";AAEA,SAAS,SAAS,sBAAsB;AACxC,SAAS,iCAAiC;AAe1C,MAAM,wBAAwB;AAAA,EAC5B,eAAe;AAAA,EACf,cAAc;AAChB;AAEA,eAAe,iBAAiB,KAAa,MAAiD;AAC5F,QAAM,WAAW,MAAM,QAAyC,mBAAmB;AACnF,QAAM,QAAQ,MAAM,QAAQ,SAAS,QAAQ,KAAK,IAAI,SAAS,QAAQ,SAAS,CAAC,IAAI,CAAC;AACtF,QAAM,WAAW,MAAM,KAAK,CAAC,SAAS,QAAQ,KAAK,QAAQ,GAAG;AAC9D,MAAI,SAAU,QAAO;AACrB,MAAI,CAAC,SAAS,GAAI,QAAO;AACzB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,KAAK,CAAC;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAS,QAAQ;AACvB,MAAI,UAAU,OAAO,MAAM,OAAO,IAAK,QAAO;AAC9C,SAAO;AACT;AAEA,eAAsB,2BAA2B,MAA4E;AAC3H,QAAM,EAAE,QAAQ,IAAI,MAAM,oBAAoB,IAAI;AAClD,SAAO;AACT;AAEA,eAAsB,oBACpB,MACqF;AACrF,QAAM,MAAM,sBAAsB,IAAI;AACtC,QAAM,OAAO,SAAS,kBAAkB,yBAAyB;AACjE,QAAM,aAAa,MAAM,iBAAiB,KAAK,IAAI;AACnD,MAAI,CAAC,WAAY,QAAO,EAAE,YAAY,MAAM,SAAS,CAAC,EAAE;AACxD,QAAM,cAAc,MAAM,0BAA0B,WAAW,EAAE;AACjE,MAAI,CAAC,YAAY,GAAI,QAAO,EAAE,YAAY,SAAS,CAAC,EAAE;AACtD,QAAM,UAAU,YAAY,MACzB,IAAI,CAAC,UAAU;AACd,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,UAAM,SAAS;AACf,UAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,QAAQ,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,EAAE,SAAS,OAAO,QAAQ;AAC9F,UAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,UAAM,OAAO,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO;AAC7D,WAAO,EAAE,OAAO,OAAO,OAAO,KAAK;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,UAA0C,CAAC,CAAC,KAAK;AAC5D,SAAO,EAAE,YAAY,QAAQ;AAC/B;AAEA,eAAsB,2BACpB,MACA,OACuC;AACvC,QAAM,MAAM,sBAAsB,IAAI;AACtC,QAAM,OAAO,SAAS,kBAAkB,yBAAyB;AACjE,QAAM,aAAa,MAAM,iBAAiB,KAAK,IAAI;AACnD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,WAAW,MAAM;AAAA,IACrB,qBAAqB,WAAW,EAAE;AAAA,IAClC;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU;AAAA,QACnB,OAAO,MAAM;AAAA,QACb,OAAO,MAAM,SAAS;AAAA,QACtB,OAAO,MAAM,SAAS;AAAA,QACtB,MAAM,MAAM,QAAQ;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,UAAU,SAAS,UAAU,CAAC;AACpC,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,EAAE,SAAS,QAAQ,QAAQ,MAAM;AACvG,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,EAAE,SAAS,QAAQ,QAAQ;AACjG,QAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,MAAM,SAAS;AACjF,QAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,MAAM,QAAQ;AAC7E,SAAO,EAAE,OAAO,OAAO,OAAO,KAAK;AACrC;",
   "names": []
 }

package/dist/modules/sync_excel/api/upload/route.js

@@ -9,7 +9,12 @@ import { buildSuggestedMapping } from "../../lib/mapping.js";
 import { parseCsvPreview } from "../../lib/parser.js";
 import { createSyncExcelUploadAttachment } from "../../lib/upload-storage.js";
 import { resolveSyncExcelConcreteScope } from "../../lib/scope.js";
-import { isMultipartRequestWithinUploadLimit, resolveDefaultAttachmentMaxUploadBytes } from "../../../attachments/lib/upload-limits.js";
+import {
+  isMultipartRequestWithinUploadLimit,
+  isMultipartUploadLimitError,
+  parseMultipartFormDataWithinUploadLimit,
+  resolveDefaultAttachmentMaxUploadBytes
+} from "../../../attachments/lib/upload-limits.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["sync_excel.run"] }
 };
@@ -58,7 +63,15 @@ async function POST(request) {
   if (!isMultipartRequestWithinUploadLimit(request.headers.get("content-length"))) {
     return NextResponse.json({ error: "CSV upload exceeds the maximum upload size." }, { status: 413 });
   }
-  const formData = await request.formData();
+  let formData;
+  try {
+    formData = await parseMultipartFormDataWithinUploadLimit(request);
+  } catch (error) {
+    if (isMultipartUploadLimitError(error)) {
+      return NextResponse.json({ error: "CSV upload exceeds the maximum upload size." }, { status: 413 });
+    }
+    throw error;
+  }
   const parsedPayload = multipartSchema.safeParse({
     entityType: typeof formData.get("entityType") === "string" ? formData.get("entityType") : void 0
   });

package/dist/modules/sync_excel/api/upload/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sync_excel/api/upload/route.ts"],
-  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { z } from 'zod'\nimport { syncExcelUploadResponseSchema, syncExcelEntityTypeSchema } from '../../data/validators'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { buildSuggestedMapping } from '../../lib/mapping'\nimport { parseCsvPreview } from '../../lib/parser'\nimport { createSyncExcelUploadAttachment } from '../../lib/upload-storage'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport { isMultipartRequestWithinUploadLimit, resolveDefaultAttachmentMaxUploadBytes } from '../../../attachments/lib/upload-limits'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst multipartSchema = z.object({\n  entityType: syncExcelEntityTypeSchema.default('customers.person'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Upload CSV file for sync_excel preview',\n  methods: {\n    POST: {\n      summary: 'Upload CSV file',\n      requestBody: {\n        contentType: 'multipart/form-data',\n      },\n      responses: [\n        { status: 200, description: 'CSV uploaded and preview parsed', schema: syncExcelUploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid multipart payload', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 413, description: 'CSV upload exceeds the maximum upload size', schema: errorSchema },\n        { status: 422, description: 'Unsupported entity type or file type', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n  if (!scopeResult.ok) {\n    return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n  }\n  const { scope } = scopeResult\n\n  const contentType = request.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const formData = await request.formData()\n  const parsedPayload = multipartSchema.safeParse({\n    entityType: typeof formData.get('entityType') === 'string' ? formData.get('entityType') : undefined,\n  })\n\n  if (!parsedPayload.success) {\n    return NextResponse.json({ error: 'Invalid upload payload.' }, { status: 422 })\n  }\n\n  const file = formData.get('file')\n  if (!(file instanceof File)) {\n    return NextResponse.json({ error: 'Select a CSV file to upload.' }, { status: 400 })\n  }\n\n  const supportedMimeTypes = new Set(['text/csv', 'application/vnd.ms-excel', 'application/csv'])\n  const isCsvByMime = supportedMimeTypes.has(file.type)\n  const isCsvByName = file.name.toLowerCase().endsWith('.csv')\n\n  if (!isCsvByMime && !isCsvByName) {\n    return NextResponse.json({ error: 'Only CSV uploads are supported in this foundation slice.' }, { status: 422 })\n  }\n\n  const maxUploadBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (file.size > maxUploadBytes) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const fileBuffer = Buffer.from(await file.arrayBuffer())\n  const preview = parseCsvPreview(fileBuffer, { maxRows: 5 })\n  const suggestedMapping = buildSuggestedMapping(parsedPayload.data.entityType, preview.headers)\n\n  const em = container.resolve('em') as EntityManager\n  const uploadId = randomUUID()\n  const attachment = await createSyncExcelUploadAttachment({\n    em,\n    uploadId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    fileName: file.name,\n    mimeType: file.type || 'text/csv',\n    buffer: fileBuffer,\n  })\n\n  const upload = em.create(SyncExcelUpload, {\n    id: uploadId,\n    attachmentId: attachment.id,\n    filename: file.name,\n    mimeType: file.type || 'text/csv',\n    fileSize: fileBuffer.length,\n    entityType: parsedPayload.data.entityType,\n    delimiter: preview.delimiter,\n    encoding: preview.encoding,\n    headers: preview.headers,\n    sampleRows: preview.sampleRows,\n    totalRows: preview.totalRows,\n    status: 'uploaded',\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n\n  em.persist(upload)\n  await em.flush()\n\n  return NextResponse.json(syncExcelUploadResponseSchema.parse({\n    uploadId: upload.id,\n    filename: upload.filename,\n    mimeType: upload.mimeType,\n    fileSize: upload.fileSize,\n    entityType: upload.entityType,\n    headers: upload.headers,\n    sampleRows: upload.sampleRows,\n    totalRows: upload.totalRows,\n    suggestedMapping,\n  }))\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,SAAS;AAClB,SAAS,+BAA+B,iCAAiC;AACzE,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC,8CAA8C;AAErF,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,YAAY,0BAA0B,QAAQ,kBAAkB;AAClE,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,8BAA8B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AACA,QAAM,EAAE,MAAM,IAAI;AAElB,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,WAAW,MAAM,QAAQ,SAAS;AACxC,QAAM,gBAAgB,gBAAgB,UAAU;AAAA,IAC9C,YAAY,OAAO,SAAS,IAAI,YAAY,MAAM,WAAW,SAAS,IAAI,YAAY,IAAI;AAAA,EAC5F,CAAC;AAED,MAAI,CAAC,cAAc,SAAS;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,EAAE,gBAAgB,OAAO;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,qBAAqB,oBAAI,IAAI,CAAC,YAAY,4BAA4B,iBAAiB,CAAC;AAC9F,QAAM,cAAc,mBAAmB,IAAI,KAAK,IAAI;AACpD,QAAM,cAAc,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM;AAE3D,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,2DAA2D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjH;AAEA,QAAM,iBAAiB,uCAAuC;AAC9D,MAAI,KAAK,OAAO,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,aAAa,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACvD,QAAM,UAAU,gBAAgB,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1D,QAAM,mBAAmB,sBAAsB,cAAc,KAAK,YAAY,QAAQ,OAAO;AAE7F,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,WAAW;AAC5B,QAAM,aAAa,MAAM,gCAAgC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,IACxC,IAAI;AAAA,IACJ,cAAc,WAAW;AAAA,IACzB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,YAAY,cAAc,KAAK;AAAA,IAC/B,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,QAAQ;AAAA,IACR,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AAED,KAAG,QAAQ,MAAM;AACjB,QAAM,GAAG,MAAM;AAEf,SAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB;AAAA,EACF,CAAC,CAAC;AACJ;",
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { z } from 'zod'\nimport { syncExcelUploadResponseSchema, syncExcelEntityTypeSchema } from '../../data/validators'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { buildSuggestedMapping } from '../../lib/mapping'\nimport { parseCsvPreview } from '../../lib/parser'\nimport { createSyncExcelUploadAttachment } from '../../lib/upload-storage'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  isMultipartUploadLimitError,\n  parseMultipartFormDataWithinUploadLimit,\n  resolveDefaultAttachmentMaxUploadBytes,\n} from '../../../attachments/lib/upload-limits'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst multipartSchema = z.object({\n  entityType: syncExcelEntityTypeSchema.default('customers.person'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Upload CSV file for sync_excel preview',\n  methods: {\n    POST: {\n      summary: 'Upload CSV file',\n      requestBody: {\n        contentType: 'multipart/form-data',\n      },\n      responses: [\n        { status: 200, description: 'CSV uploaded and preview parsed', schema: syncExcelUploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid multipart payload', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 413, description: 'CSV upload exceeds the maximum upload size', schema: errorSchema },\n        { status: 422, description: 'Unsupported entity type or file type', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n  if (!scopeResult.ok) {\n    return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n  }\n  const { scope } = scopeResult\n\n  const contentType = request.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  let formData: FormData\n  try {\n    formData = await parseMultipartFormDataWithinUploadLimit(request)\n  } catch (error) {\n    if (isMultipartUploadLimitError(error)) {\n      return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n    }\n    throw error\n  }\n  const parsedPayload = multipartSchema.safeParse({\n    entityType: typeof formData.get('entityType') === 'string' ? formData.get('entityType') : undefined,\n  })\n\n  if (!parsedPayload.success) {\n    return NextResponse.json({ error: 'Invalid upload payload.' }, { status: 422 })\n  }\n\n  const file = formData.get('file')\n  if (!(file instanceof File)) {\n    return NextResponse.json({ error: 'Select a CSV file to upload.' }, { status: 400 })\n  }\n\n  const supportedMimeTypes = new Set(['text/csv', 'application/vnd.ms-excel', 'application/csv'])\n  const isCsvByMime = supportedMimeTypes.has(file.type)\n  const isCsvByName = file.name.toLowerCase().endsWith('.csv')\n\n  if (!isCsvByMime && !isCsvByName) {\n    return NextResponse.json({ error: 'Only CSV uploads are supported in this foundation slice.' }, { status: 422 })\n  }\n\n  const maxUploadBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (file.size > maxUploadBytes) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const fileBuffer = Buffer.from(await file.arrayBuffer())\n  const preview = parseCsvPreview(fileBuffer, { maxRows: 5 })\n  const suggestedMapping = buildSuggestedMapping(parsedPayload.data.entityType, preview.headers)\n\n  const em = container.resolve('em') as EntityManager\n  const uploadId = randomUUID()\n  const attachment = await createSyncExcelUploadAttachment({\n    em,\n    uploadId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    fileName: file.name,\n    mimeType: file.type || 'text/csv',\n    buffer: fileBuffer,\n  })\n\n  const upload = em.create(SyncExcelUpload, {\n    id: uploadId,\n    attachmentId: attachment.id,\n    filename: file.name,\n    mimeType: file.type || 'text/csv',\n    fileSize: fileBuffer.length,\n    entityType: parsedPayload.data.entityType,\n    delimiter: preview.delimiter,\n    encoding: preview.encoding,\n    headers: preview.headers,\n    sampleRows: preview.sampleRows,\n    totalRows: preview.totalRows,\n    status: 'uploaded',\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n\n  em.persist(upload)\n  await em.flush()\n\n  return NextResponse.json(syncExcelUploadResponseSchema.parse({\n    uploadId: upload.id,\n    filename: upload.filename,\n    mimeType: upload.mimeType,\n    fileSize: upload.fileSize,\n    entityType: upload.entityType,\n    headers: upload.headers,\n    sampleRows: upload.sampleRows,\n    totalRows: upload.totalRows,\n    suggestedMapping,\n  }))\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,SAAS;AAClB,SAAS,+BAA+B,iCAAiC;AACzE,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,YAAY,0BAA0B,QAAQ,kBAAkB;AAClE,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,8BAA8B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AACA,QAAM,EAAE,MAAM,IAAI;AAElB,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wCAAwC,OAAO;AAAA,EAClE,SAAS,OAAO;AACd,QAAI,4BAA4B,KAAK,GAAG;AACtC,aAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,UAAM;AAAA,EACR;AACA,QAAM,gBAAgB,gBAAgB,UAAU;AAAA,IAC9C,YAAY,OAAO,SAAS,IAAI,YAAY,MAAM,WAAW,SAAS,IAAI,YAAY,IAAI;AAAA,EAC5F,CAAC;AAED,MAAI,CAAC,cAAc,SAAS;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,EAAE,gBAAgB,OAAO;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,qBAAqB,oBAAI,IAAI,CAAC,YAAY,4BAA4B,iBAAiB,CAAC;AAC9F,QAAM,cAAc,mBAAmB,IAAI,KAAK,IAAI;AACpD,QAAM,cAAc,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM;AAE3D,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,2DAA2D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjH;AAEA,QAAM,iBAAiB,uCAAuC;AAC9D,MAAI,KAAK,OAAO,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,aAAa,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACvD,QAAM,UAAU,gBAAgB,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1D,QAAM,mBAAmB,sBAAsB,cAAc,KAAK,YAAY,QAAQ,OAAO;AAE7F,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,WAAW;AAC5B,QAAM,aAAa,MAAM,gCAAgC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,IACxC,IAAI;AAAA,IACJ,cAAc,WAAW;AAAA,IACzB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,YAAY,cAAc,KAAK;AAAA,IAC/B,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,QAAQ;AAAA,IACR,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AAED,KAAG,QAAQ,MAAM;AACjB,QAAM,GAAG,MAAM;AAEf,SAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB;AAAA,EACF,CAAC,CAAC;AACJ;",
   "names": []
 }

package/dist/modules/sync_excel/widgets/injection/upload-config/widget.client.js

@@ -888,7 +888,7 @@ function StatusAlert({
   title,
   message
 }) {
-  return /* @__PURE__ */ jsxs(Alert, { variant: variant === "error" ? "destructive" : variant, children: [
+  return /* @__PURE__ */ jsxs(Alert, { status: variant === "info" ? "information" : variant, children: [
     /* @__PURE__ */ jsx(AlertTitle, { children: title }),
     /* @__PURE__ */ jsx(AlertDescription, { children: message })
   ] });