@open-mercato/core 0.6.8-develop.6899.1.433952fd93 → 0.6.8-develop.6903.1.0ec850a22b

package/dist/modules/audit_logs/api/audit-logs/actions/undo/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { z } from "zod";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("audit_logs").child({ component: "undo" });
@@ -79,6 +80,10 @@ async function POST(req) {
     await commandBus.undo(undoToken, ctx);
     return NextResponse.json({ ok: true, logId: target.id });
   } catch (err) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
     logger.error("Undo failed", { err });
     return NextResponse.json({ error: "Undo failed" }, { status: 400 });
   }
@@ -111,7 +116,12 @@ const openApi = {
       errors: [
         { status: 400, description: "Invalid or unavailable undo token", schema: errorSchema },
         { status: 401, description: "Authentication required", schema: errorSchema },
-        { status: 403, description: "Undo blocked by organization or tenant scope", schema: errorSchema }
+        { status: 403, description: "Undo blocked by organization or tenant scope", schema: errorSchema },
+        {
+          status: 422,
+          description: "Undo deliberately blocked by a beforeUndo command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body.",
+          schema: errorSchema
+        }
       ]
     }
   }

package/dist/modules/audit_logs/api/audit-logs/actions/undo/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/audit_logs/api/audit-logs/actions/undo/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { AwilixContainer } from 'awilix'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'undo' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.undo_self'] },\n}\n\ntype UndoRequestBody = {\n  undoToken?: string\n}\n\nconst undoRequestSchema = z.object({\n  undoToken: z.string().min(1).describe('Undo token issued by the action log entry'),\n})\n\nconst undoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().describe('Identifier of the action log that was undone'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as UndoRequestBody | null\n  const undoToken = body?.undoToken?.trim()\n  if (!undoToken) return NextResponse.json({ error: 'Invalid undo token' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canUndoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.undo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const target = await logs.findByUndoToken(undoToken)\n  if (!target || target.executionState !== 'done') {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  // Fail closed on tenant scope: `audit_logs.undo_tenant` only widens scope WITHIN a\n  // tenant, never across tenants, so a tenant-scoped target always requires a caller\n  // bound to that same tenant. A caller whose tenantId is null (tenant-less global\n  // account or unscoped API key) must never undo a tenant-scoped row (issue #2685).\n  if (target.tenantId && target.tenantId !== (auth.tenantId ?? null)) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  // Tenant-level undoers may undo across organizations within the tenant, so an\n  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.\n  // Every other caller must resolve to the target's own organization \u2014 a null caller\n  // org must not bypass an org-scoped target (issue #2685).\n  const orgScopeMismatch = canUndoTenant\n    ? Boolean(target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId)\n    : Boolean(target.organizationId && target.organizationId !== scopedOrgId)\n  if (orgScopeMismatch) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canUndoTenant ? (target.actorUserId ?? auth.sub) : auth.sub\n  // Scope the latest-undoable re-lookup to the target row's own organization, not\n  // the caller's currently-resolved org. The actor/tenant/org guards above already\n  // authorized the caller for this row; reusing the caller's scope here breaks undo\n  // for tenant-level rows (organization create/update/delete/reparent log with a\n  // null organization_id) whenever the caller resolves to a concrete home org, so\n  // the lookup never matches and returns \"Undo token not available\" (issue #2398).\n  const lookupOrgId = target.organizationId ?? null\n  let latest = null\n  if (target.resourceKind || target.resourceId) {\n    latest = await logs.latestUndoableForResource({\n      actorUserId: lookupActorId,\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n      resourceKind: target.resourceKind ?? undefined,\n      resourceId: target.resourceId ?? undefined,\n    })\n  }\n  if (!latest) {\n    latest = await logs.latestUndoableForActor(lookupActorId, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n    })\n  }\n  if (!latest || latest.id !== target.id) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    await commandBus.undo(undoToken, ctx)\n    return NextResponse.json({ ok: true, logId: target.id })\n  } catch (err) {\n    logger.error('Undo failed', { err })\n    return NextResponse.json({ error: 'Undo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Undo a recent action',\n  description: 'Executes the undo operation for the most recent undoable action belonging to the caller.',\n  methods: {\n    POST: {\n      summary: 'Undo action by token',\n      description:\n        'Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: undoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Undo applied successfully', schema: undoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid or unavailable undo token', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Undo blocked by organization or tenant scope', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAM/E,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE9D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,2CAA2C;AACnF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAC3E,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,YAAY,MAAM,WAAW,KAAK;AACxC,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS;AACnD,MAAI,CAAC,UAAU,OAAO,mBAAmB,QAAQ;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,eAAe,OAAO,gBAAgB,KAAK,OAAO,CAAC,eAAe;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAKA,MAAI,OAAO,YAAY,OAAO,cAAc,KAAK,YAAY,OAAO;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAK7F,QAAM,mBAAmB,gBACrB,QAAQ,OAAO,kBAAkB,eAAe,OAAO,mBAAmB,WAAW,IACrF,QAAQ,OAAO,kBAAkB,OAAO,mBAAmB,WAAW;AAC1E,MAAI,kBAAkB;AACpB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,gBAAgB,gBAAiB,OAAO,eAAe,KAAK,MAAO,KAAK;AAO9E,QAAM,cAAc,OAAO,kBAAkB;AAC7C,MAAI,SAAS;AACb,MAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,aAAS,MAAM,KAAK,0BAA0B;AAAA,MAC5C,aAAa;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,MAChB,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY,OAAO,cAAc;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,KAAK,uBAAuB,eAAe;AAAA,MACxD,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO,IAAI;AACtC,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,WAAW,KAAK,WAAW,GAAG;AACpC,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,GAAG,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,WAAO,MAAM,eAAe,EAAE,IAAI,CAAC;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,mBAAmB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,MAClG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { AwilixContainer } from 'awilix'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'undo' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.undo_self'] },\n}\n\ntype UndoRequestBody = {\n  undoToken?: string\n}\n\nconst undoRequestSchema = z.object({\n  undoToken: z.string().min(1).describe('Undo token issued by the action log entry'),\n})\n\nconst undoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().describe('Identifier of the action log that was undone'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as UndoRequestBody | null\n  const undoToken = body?.undoToken?.trim()\n  if (!undoToken) return NextResponse.json({ error: 'Invalid undo token' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canUndoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.undo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const target = await logs.findByUndoToken(undoToken)\n  if (!target || target.executionState !== 'done') {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  if (target.actorUserId && target.actorUserId !== auth.sub && !canUndoTenant) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  // Fail closed on tenant scope: `audit_logs.undo_tenant` only widens scope WITHIN a\n  // tenant, never across tenants, so a tenant-scoped target always requires a caller\n  // bound to that same tenant. A caller whose tenantId is null (tenant-less global\n  // account or unscoped API key) must never undo a tenant-scoped row (issue #2685).\n  if (target.tenantId && target.tenantId !== (auth.tenantId ?? null)) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n  const scopedOrgId = canUndoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  // Tenant-level undoers may undo across organizations within the tenant, so an\n  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.\n  // Every other caller must resolve to the target's own organization \u2014 a null caller\n  // org must not bypass an org-scoped target (issue #2685).\n  const orgScopeMismatch = canUndoTenant\n    ? Boolean(target.organizationId && scopedOrgId && target.organizationId !== scopedOrgId)\n    : Boolean(target.organizationId && target.organizationId !== scopedOrgId)\n  if (orgScopeMismatch) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canUndoTenant ? (target.actorUserId ?? auth.sub) : auth.sub\n  // Scope the latest-undoable re-lookup to the target row's own organization, not\n  // the caller's currently-resolved org. The actor/tenant/org guards above already\n  // authorized the caller for this row; reusing the caller's scope here breaks undo\n  // for tenant-level rows (organization create/update/delete/reparent log with a\n  // null organization_id) whenever the caller resolves to a concrete home org, so\n  // the lookup never matches and returns \"Undo token not available\" (issue #2398).\n  const lookupOrgId = target.organizationId ?? null\n  let latest = null\n  if (target.resourceKind || target.resourceId) {\n    latest = await logs.latestUndoableForResource({\n      actorUserId: lookupActorId,\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n      resourceKind: target.resourceKind ?? undefined,\n      resourceId: target.resourceId ?? undefined,\n    })\n  }\n  if (!latest) {\n    latest = await logs.latestUndoableForActor(lookupActorId, {\n      tenantId: auth.tenantId ?? null,\n      organizationId: lookupOrgId,\n    })\n  }\n  if (!latest || latest.id !== target.id) {\n    return NextResponse.json({ error: 'Undo token not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    await commandBus.undo(undoToken, ctx)\n    return NextResponse.json({ ok: true, logId: target.id })\n  } catch (err) {\n    // A beforeUndo interceptor that blocked with an explicit status is a deliberate business\n    // rejection, not an undo failure \u2014 surface its status and message (issue #5045).\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Undo failed', { err })\n    return NextResponse.json({ error: 'Undo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Undo a recent action',\n  description: 'Executes the undo operation for the most recent undoable action belonging to the caller.',\n  methods: {\n    POST: {\n      summary: 'Undo action by token',\n      description:\n        'Replays the undo handler registered for a command. The provided undo token must match the latest undoable log entry accessible to the caller.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: undoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Undo applied successfully', schema: undoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid or unavailable undo token', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Undo blocked by organization or tenant scope', schema: errorSchema },\n        {\n          status: 422,\n          description:\n            'Undo deliberately blocked by a beforeUndo command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body.',\n          schema: errorSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAK/E,SAAS,0CAA0C;AAEnD,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE9D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,2CAA2C;AACnF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,8CAA8C;AAC3E,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,YAAY,MAAM,WAAW,KAAK;AACxC,MAAI,CAAC,UAAW,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS;AACnD,MAAI,CAAC,UAAU,OAAO,mBAAmB,QAAQ;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,MAAI,OAAO,eAAe,OAAO,gBAAgB,KAAK,OAAO,CAAC,eAAe;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAKA,MAAI,OAAO,YAAY,OAAO,cAAc,KAAK,YAAY,OAAO;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAK7F,QAAM,mBAAmB,gBACrB,QAAQ,OAAO,kBAAkB,eAAe,OAAO,mBAAmB,WAAW,IACrF,QAAQ,OAAO,kBAAkB,OAAO,mBAAmB,WAAW;AAC1E,MAAI,kBAAkB;AACpB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,QAAM,gBAAgB,gBAAiB,OAAO,eAAe,KAAK,MAAO,KAAK;AAO9E,QAAM,cAAc,OAAO,kBAAkB;AAC7C,MAAI,SAAS;AACb,MAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,aAAS,MAAM,KAAK,0BAA0B;AAAA,MAC5C,aAAa;AAAA,MACb,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,MAChB,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY,OAAO,cAAc;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,CAAC,QAAQ;AACX,aAAS,MAAM,KAAK,uBAAuB,eAAe;AAAA,MACxD,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AACA,MAAI,CAAC,UAAU,OAAO,OAAO,OAAO,IAAI;AACtC,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,WAAW,KAAK,WAAW,GAAG;AACpC,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,GAAG,CAAC;AAAA,EACzD,SAAS,KAAK;AAGZ,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,eAAe,EAAE,IAAI,CAAC;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,mBAAmB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,QAChG;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/dashboards/api/layout/route.js

@@ -84,6 +84,7 @@ async function GET(req) {
     widgets
   );
   const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id));
+  const hasRegisteredWidgets = widgets.length > 0;
   let layout = await loadScopeLayout(em, scope);
   let items = layout ? normalizeLayoutItems(layout.layoutJson) : [];
   let hasChanged = false;
@@ -97,15 +98,17 @@ async function GET(req) {
       size: widget.metadata.defaultSize ?? DEFAULT_SIZE,
       settings: widget.metadata.defaultSettings ?? void 0
     }));
-    layout = em.create(DashboardLayout, {
-      userId: scope.userId,
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      layoutJson: items
-    });
-    em.persist(layout);
-    hasChanged = true;
-  } else {
+    if (hasRegisteredWidgets) {
+      layout = em.create(DashboardLayout, {
+        userId: scope.userId,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        layoutJson: items
+      });
+      em.persist(layout);
+      hasChanged = true;
+    }
+  } else if (hasRegisteredWidgets) {
     const existingLayout = layout;
     const filtered = items.filter((item) => allowedIds.includes(item.widgetId));
     if (filtered.length !== items.length) {
@@ -214,6 +217,9 @@ async function PUT(req) {
     return NextResponse.json(guardResult.body, { status: guardResult.status });
   }
   const widgets = await loadAllWidgets();
+  if (widgets.length === 0) {
+    return NextResponse.json({ error: "Widget registry unavailable" }, { status: 503 });
+  }
   const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId
@@ -301,7 +307,8 @@ const layoutPutDoc = {
   errors: [
     { status: 400, description: "Invalid layout payload", schema: dashboardsErrorSchema },
     { status: 401, description: "Authentication required", schema: dashboardsErrorSchema },
-    { status: 403, description: "Missing dashboards.configure feature", schema: dashboardsErrorSchema }
+    { status: 403, description: "Missing dashboards.configure feature", schema: dashboardsErrorSchema },
+    { status: 503, description: "Widget registry unavailable \u2014 the layout was not saved", schema: dashboardsErrorSchema }
   ]
 };
 const openApi = {

package/dist/modules/dashboards/api/layout/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/dashboards/api/layout/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { randomUUID } from 'node:crypto'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutStateSchema,\n} from '../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\ntype LayoutScope = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nasync function loadScopeLayout(em: any, scope: LayoutScope): Promise<DashboardLayout | null> {\n  return await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n}\n\nfunction normalizeLayoutItems(items: any[]) {\n  const list = Array.isArray(items) ? items : []\n  const seenIds = new Set<string>()\n  const sanitized = list\n    .filter((item) => item && typeof item === 'object')\n    .map((item) => ({\n      id: String(item.id),\n      widgetId: String(item.widgetId),\n      order: Number.isInteger(item.order) ? Number(item.order) : undefined,\n      priority: Number.isInteger(item.priority) ? Number(item.priority) : undefined,\n      size: typeof item.size === 'string' ? item.size : undefined,\n      settings: item.settings,\n    }))\n    .filter((item) => {\n      if (!item.id || !item.widgetId) return false\n      if (seenIds.has(item.id)) return false\n      seenIds.add(item.id)\n      return true\n    })\n    .sort((a, b) => {\n      const aOrder = a.order ?? a.priority ?? 0\n      const bOrder = b.order ?? b.priority ?? 0\n      return aOrder - bOrder\n    })\n    .map((item, idx) => ({ ...item, order: idx, priority: idx }))\n  return sanitized\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  // Use a fresh fork to avoid carrying over pending entities from other operations\n  const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = container.resolve('rbacService') as any\n  const url = new URL(req.url)\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const widgets = await loadAllWidgets()\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id))\n\n  let layout = await loadScopeLayout(em, scope)\n  let items = layout ? normalizeLayoutItems(layout.layoutJson) : []\n  let hasChanged = false\n\n  if (!layout) {\n    const defaults = allowedWidgets.filter((widget) => widget.metadata.defaultEnabled)\n    items = defaults.map((widget, index) => ({\n      id: randomUUID(),\n      widgetId: widget.metadata.id,\n      order: index,\n      priority: index,\n      size: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      settings: widget.metadata.defaultSettings ?? undefined,\n    }))\n    layout = em.create(DashboardLayout, {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      layoutJson: items,\n    })\n    em.persist(layout)\n    hasChanged = true\n  } else {\n    const existingLayout = layout\n    const filtered = items.filter((item) => allowedIds.includes(item.widgetId))\n    if (filtered.length !== items.length) {\n      hasChanged = true\n      items = filtered\n    }\n    items = items.map((item, index) => (item.order !== index || item.priority !== index ? { ...item, order: index, priority: index } : item))\n    if (\n      existingLayout.layoutJson.length !== items.length ||\n      items.some((item, idx) => existingLayout.layoutJson[idx]?.id !== item.id)\n    ) {\n      hasChanged = true\n    }\n    existingLayout.layoutJson = items\n    layout = existingLayout\n  }\n\n  if (hasChanged) {\n    await em.flush()\n  }\n\n  const canConfigure = authorizeFeatures(['dashboards.configure'], {\n    grantedFeatures: effectiveFeatures,\n  })\n\n  let userEmail: string | null = null\n  let userName: string | null = null\n  let userLabel: string | null = null\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { id: scope.userId, deletedAt: null },\n    undefined,\n    { tenantId: scope.tenantId ?? null, organizationId: scope.organizationId ?? null },\n  )\n  if (user) {\n    userName = user.name?.trim() ?? null\n    userEmail = user.email ?? null\n    userLabel = (userName && userName.length > 0 ? userName : userEmail) ?? null\n  }\n  if (!userLabel) {\n    userLabel = scope.userId\n  }\n\n  const response = {\n    layout: { items },\n    allowedWidgetIds: allowedIds,\n    canConfigure,\n    context: {\n      ...scope,\n      userName,\n      userEmail,\n      userLabel,\n    },\n    widgets: allowedWidgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid layout payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = resolve('rbacService') as any\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    scope.userId,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: RESOURCE_KIND,\n    resourceId: scope.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { items: parsed.data.items },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const widgets = await loadAllWidgets()\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedSet = new Set(allowedIds)\n\n  const payloadItems = parsed.data.items\n  const sanitized = payloadItems\n    .map((item, index) => ({\n      id: item.id,\n      widgetId: item.widgetId,\n      order: index,\n      priority: index,\n      size: item.size ?? DEFAULT_SIZE,\n      settings: item.settings,\n    }))\n    .filter((item) => allowedSet.has(item.widgetId))\n\n  const uniqueIds = new Set(sanitized.map((item) => item.id))\n  if (uniqueIds.size !== sanitized.length) {\n    return NextResponse.json({ error: 'Layout item IDs must be unique' }, { status: 400 })\n  }\n\n  let layout = await loadScopeLayout(em, scope)\n  if (!layout) {\n    layout = em.create(DashboardLayout, {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      layoutJson: sanitized,\n    })\n    em.persist(layout)\n  } else {\n    layout.layoutJson = sanitized\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: scope.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutGetDoc: OpenApiMethodDoc = {\n  summary: 'Load the current dashboard layout',\n  description: 'Returns the saved widget layout together with the widgets the current user is allowed to place.',\n  tags: [dashboardsTag],\n  responses: [\n    {\n      status: 200,\n      description: 'Current dashboard layout and available widgets.',\n      schema: dashboardLayoutStateSchema,\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst layoutPutDoc: OpenApiMethodDoc = {\n  summary: 'Persist dashboard layout changes',\n  description: 'Saves the provided widget ordering, sizes, and settings for the current user.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutSchema,\n    description: 'List of dashboard widgets with ordering, sizing, and settings.',\n  },\n  responses: [\n    { status: 200, description: 'Layout updated successfully.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid layout payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage personal dashboard layout',\n  methods: {\n    GET: layoutGetDoc,\n    PUT: layoutPutDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAQA,eAAe,gBAAgB,IAAS,OAAqD;AAC3F,SAAO,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IACvC,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAc;AAC1C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AAC7C,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,YAAY,KACf,OAAO,CAAC,SAAS,QAAQ,OAAO,SAAS,QAAQ,EACjD,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,UAAU,OAAO,KAAK,QAAQ;AAAA,IAC9B,OAAO,OAAO,UAAU,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI;AAAA,IAC3D,UAAU,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,IAAI;AAAA,IACpE,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS;AAChB,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAU,QAAO;AACvC,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG,QAAO;AACjC,YAAQ,IAAI,KAAK,EAAE;AACnB,WAAO;AAAA,EACT,CAAC,EACA,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,WAAO,SAAS;AAAA,EAClB,CAAC,EACA,IAAI,CAAC,MAAM,SAAS,EAAE,GAAG,MAAM,OAAO,KAAK,UAAU,IAAI,EAAE;AAC9D,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAE/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AAC3G,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAE3B,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,QAAQ,OAAO,CAAC,MAAM,WAAW,SAAS,EAAE,SAAS,EAAE,CAAC;AAE/E,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,QAAQ,SAAS,qBAAqB,OAAO,UAAU,IAAI,CAAC;AAChE,MAAI,aAAa;AAEjB,MAAI,CAAC,QAAQ;AACX,UAAM,WAAW,eAAe,OAAO,CAAC,WAAW,OAAO,SAAS,cAAc;AACjF,YAAQ,SAAS,IAAI,CAAC,QAAQ,WAAW;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,UAAU,OAAO,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,MAAM,OAAO,SAAS,eAAe;AAAA,MACrC,UAAU,OAAO,SAAS,mBAAmB;AAAA,IAC/C,EAAE;AACF,aAAS,GAAG,OAAO,iBAAiB;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AACD,OAAG,QAAQ,MAAM;AACjB,iBAAa;AAAA,EACf,OAAO;AACL,UAAM,iBAAiB;AACvB,UAAM,WAAW,MAAM,OAAO,CAAC,SAAS,WAAW,SAAS,KAAK,QAAQ,CAAC;AAC1E,QAAI,SAAS,WAAW,MAAM,QAAQ;AACpC,mBAAa;AACb,cAAQ;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,CAAC,MAAM,UAAW,KAAK,UAAU,SAAS,KAAK,aAAa,QAAQ,EAAE,GAAG,MAAM,OAAO,OAAO,UAAU,MAAM,IAAI,IAAK;AACxI,QACE,eAAe,WAAW,WAAW,MAAM,UAC3C,MAAM,KAAK,CAAC,MAAM,QAAQ,eAAe,WAAW,GAAG,GAAG,OAAO,KAAK,EAAE,GACxE;AACA,mBAAa;AAAA,IACf;AACA,mBAAe,aAAa;AAC5B,aAAS;AAAA,EACX;AAEA,MAAI,YAAY;AACd,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,QAAM,eAAe,kBAAkB,CAAC,sBAAsB,GAAG;AAAA,IAC/D,iBAAiB;AAAA,EACnB,CAAC;AAED,MAAI,YAA2B;AAC/B,MAAI,WAA0B;AAC9B,MAAI,YAA2B;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,QAAQ,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,MAAM,YAAY,MAAM,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,MAAI,MAAM;AACR,eAAW,KAAK,MAAM,KAAK,KAAK;AAChC,gBAAY,KAAK,SAAS;AAC1B,iBAAa,YAAY,SAAS,SAAS,IAAI,WAAW,cAAc;AAAA,EAC1E;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM;AAAA,EACpB;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,MAAM;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,MACP,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS,eAAe,IAAI,CAAC,YAAY;AAAA,MACvC,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAM,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjG,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,MAAM;AAAA,IACN,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,OAAO,OAAO,KAAK,MAAM;AAAA,EAC9C,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU;AAErC,QAAM,eAAe,OAAO,KAAK;AACjC,QAAM,YAAY,aACf,IAAI,CAAC,MAAM,WAAW;AAAA,IACrB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,OAAO;AAAA,IACP,UAAU;AAAA,IACV,MAAM,KAAK,QAAQ;AAAA,IACnB,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS,WAAW,IAAI,KAAK,QAAQ,CAAC;AAEjD,QAAM,YAAY,IAAI,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC1D,MAAI,UAAU,SAAS,UAAU,QAAQ;AACvC,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,iBAAiB;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,aAAa;AAAA,EACtB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mBAAmB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,sBAAsB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,EACpG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { randomUUID } from 'node:crypto'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutStateSchema,\n} from '../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\ntype LayoutScope = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nasync function loadScopeLayout(em: any, scope: LayoutScope): Promise<DashboardLayout | null> {\n  return await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n}\n\nfunction normalizeLayoutItems(items: any[]) {\n  const list = Array.isArray(items) ? items : []\n  const seenIds = new Set<string>()\n  const sanitized = list\n    .filter((item) => item && typeof item === 'object')\n    .map((item) => ({\n      id: String(item.id),\n      widgetId: String(item.widgetId),\n      order: Number.isInteger(item.order) ? Number(item.order) : undefined,\n      priority: Number.isInteger(item.priority) ? Number(item.priority) : undefined,\n      size: typeof item.size === 'string' ? item.size : undefined,\n      settings: item.settings,\n    }))\n    .filter((item) => {\n      if (!item.id || !item.widgetId) return false\n      if (seenIds.has(item.id)) return false\n      seenIds.add(item.id)\n      return true\n    })\n    .sort((a, b) => {\n      const aOrder = a.order ?? a.priority ?? 0\n      const bOrder = b.order ?? b.priority ?? 0\n      return aOrder - bOrder\n    })\n    .map((item, idx) => ({ ...item, order: idx, priority: idx }))\n  return sanitized\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  // Use a fresh fork to avoid carrying over pending entities from other operations\n  const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = container.resolve('rbacService') as any\n  const url = new URL(req.url)\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const widgets = await loadAllWidgets()\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id))\n\n  // An empty widget registry means the module registry has not been populated yet\n  // (a boot race), not that this app has no widgets. Every write below is derived\n  // from it, so a read request must persist nothing until it recovers \u2014 otherwise a\n  // restart-recoverable glitch is written into saved layouts for good (#5041).\n  // Note this keys off the registry, not off `allowedIds`: a user whose allowlist is\n  // legitimately empty on a healthy registry is still pruned and seeded as before.\n  const hasRegisteredWidgets = widgets.length > 0\n\n  let layout = await loadScopeLayout(em, scope)\n  let items = layout ? normalizeLayoutItems(layout.layoutJson) : []\n  let hasChanged = false\n\n  if (!layout) {\n    const defaults = allowedWidgets.filter((widget) => widget.metadata.defaultEnabled)\n    items = defaults.map((widget, index) => ({\n      id: randomUUID(),\n      widgetId: widget.metadata.id,\n      order: index,\n      priority: index,\n      size: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      settings: widget.metadata.defaultSettings ?? undefined,\n    }))\n    if (hasRegisteredWidgets) {\n      layout = em.create(DashboardLayout, {\n        userId: scope.userId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        layoutJson: items,\n      })\n      em.persist(layout)\n      hasChanged = true\n    }\n  } else if (hasRegisteredWidgets) {\n    const existingLayout = layout\n    const filtered = items.filter((item) => allowedIds.includes(item.widgetId))\n    if (filtered.length !== items.length) {\n      hasChanged = true\n      items = filtered\n    }\n    items = items.map((item, index) => (item.order !== index || item.priority !== index ? { ...item, order: index, priority: index } : item))\n    if (\n      existingLayout.layoutJson.length !== items.length ||\n      items.some((item, idx) => existingLayout.layoutJson[idx]?.id !== item.id)\n    ) {\n      hasChanged = true\n    }\n    existingLayout.layoutJson = items\n    layout = existingLayout\n  }\n\n  if (hasChanged) {\n    await em.flush()\n  }\n\n  const canConfigure = authorizeFeatures(['dashboards.configure'], {\n    grantedFeatures: effectiveFeatures,\n  })\n\n  let userEmail: string | null = null\n  let userName: string | null = null\n  let userLabel: string | null = null\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { id: scope.userId, deletedAt: null },\n    undefined,\n    { tenantId: scope.tenantId ?? null, organizationId: scope.organizationId ?? null },\n  )\n  if (user) {\n    userName = user.name?.trim() ?? null\n    userEmail = user.email ?? null\n    userLabel = (userName && userName.length > 0 ? userName : userEmail) ?? null\n  }\n  if (!userLabel) {\n    userLabel = scope.userId\n  }\n\n  const response = {\n    layout: { items },\n    allowedWidgetIds: allowedIds,\n    canConfigure,\n    context: {\n      ...scope,\n      userName,\n      userEmail,\n      userLabel,\n    },\n    widgets: allowedWidgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid layout payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = resolve('rbacService') as any\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    scope.userId,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: RESOURCE_KIND,\n    resourceId: scope.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { items: parsed.data.items },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const widgets = await loadAllWidgets()\n  // The allowlist below is derived from the registry, and this handler persists the\n  // filtered result unconditionally. An empty registry \u2014 the boot race behind #5041 \u2014\n  // would drop every submitted item and save `[]` while answering `{ ok: true }`, so a\n  // stale tab reordering a widget could erase the layout it just rendered. Fail the\n  // write instead: the save is explicit, so the client must learn it did not happen\n  // and retry, rather than be told a wipe succeeded.\n  if (widgets.length === 0) {\n    return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })\n  }\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedSet = new Set(allowedIds)\n\n  const payloadItems = parsed.data.items\n  const sanitized = payloadItems\n    .map((item, index) => ({\n      id: item.id,\n      widgetId: item.widgetId,\n      order: index,\n      priority: index,\n      size: item.size ?? DEFAULT_SIZE,\n      settings: item.settings,\n    }))\n    .filter((item) => allowedSet.has(item.widgetId))\n\n  const uniqueIds = new Set(sanitized.map((item) => item.id))\n  if (uniqueIds.size !== sanitized.length) {\n    return NextResponse.json({ error: 'Layout item IDs must be unique' }, { status: 400 })\n  }\n\n  let layout = await loadScopeLayout(em, scope)\n  if (!layout) {\n    layout = em.create(DashboardLayout, {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      layoutJson: sanitized,\n    })\n    em.persist(layout)\n  } else {\n    layout.layoutJson = sanitized\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: scope.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutGetDoc: OpenApiMethodDoc = {\n  summary: 'Load the current dashboard layout',\n  description: 'Returns the saved widget layout together with the widgets the current user is allowed to place.',\n  tags: [dashboardsTag],\n  responses: [\n    {\n      status: 200,\n      description: 'Current dashboard layout and available widgets.',\n      schema: dashboardLayoutStateSchema,\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst layoutPutDoc: OpenApiMethodDoc = {\n  summary: 'Persist dashboard layout changes',\n  description: 'Saves the provided widget ordering, sizes, and settings for the current user.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutSchema,\n    description: 'List of dashboard widgets with ordering, sizing, and settings.',\n  },\n  responses: [\n    { status: 200, description: 'Layout updated successfully.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid layout payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n    { status: 503, description: 'Widget registry unavailable \u2014 the layout was not saved', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage personal dashboard layout',\n  methods: {\n    GET: layoutGetDoc,\n    PUT: layoutPutDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAQA,eAAe,gBAAgB,IAAS,OAAqD;AAC3F,SAAO,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IACvC,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAc;AAC1C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AAC7C,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,YAAY,KACf,OAAO,CAAC,SAAS,QAAQ,OAAO,SAAS,QAAQ,EACjD,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,UAAU,OAAO,KAAK,QAAQ;AAAA,IAC9B,OAAO,OAAO,UAAU,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI;AAAA,IAC3D,UAAU,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,IAAI;AAAA,IACpE,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS;AAChB,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAU,QAAO;AACvC,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG,QAAO;AACjC,YAAQ,IAAI,KAAK,EAAE;AACnB,WAAO;AAAA,EACT,CAAC,EACA,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,WAAO,SAAS;AAAA,EAClB,CAAC,EACA,IAAI,CAAC,MAAM,SAAS,EAAE,GAAG,MAAM,OAAO,KAAK,UAAU,IAAI,EAAE;AAC9D,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAE/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AAC3G,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAE3B,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,QAAQ,OAAO,CAAC,MAAM,WAAW,SAAS,EAAE,SAAS,EAAE,CAAC;AAQ/E,QAAM,uBAAuB,QAAQ,SAAS;AAE9C,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,QAAQ,SAAS,qBAAqB,OAAO,UAAU,IAAI,CAAC;AAChE,MAAI,aAAa;AAEjB,MAAI,CAAC,QAAQ;AACX,UAAM,WAAW,eAAe,OAAO,CAAC,WAAW,OAAO,SAAS,cAAc;AACjF,YAAQ,SAAS,IAAI,CAAC,QAAQ,WAAW;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,UAAU,OAAO,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,MAAM,OAAO,SAAS,eAAe;AAAA,MACrC,UAAU,OAAO,SAAS,mBAAmB;AAAA,IAC/C,EAAE;AACF,QAAI,sBAAsB;AACxB,eAAS,GAAG,OAAO,iBAAiB;AAAA,QAClC,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,YAAY;AAAA,MACd,CAAC;AACD,SAAG,QAAQ,MAAM;AACjB,mBAAa;AAAA,IACf;AAAA,EACF,WAAW,sBAAsB;AAC/B,UAAM,iBAAiB;AACvB,UAAM,WAAW,MAAM,OAAO,CAAC,SAAS,WAAW,SAAS,KAAK,QAAQ,CAAC;AAC1E,QAAI,SAAS,WAAW,MAAM,QAAQ;AACpC,mBAAa;AACb,cAAQ;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,CAAC,MAAM,UAAW,KAAK,UAAU,SAAS,KAAK,aAAa,QAAQ,EAAE,GAAG,MAAM,OAAO,OAAO,UAAU,MAAM,IAAI,IAAK;AACxI,QACE,eAAe,WAAW,WAAW,MAAM,UAC3C,MAAM,KAAK,CAAC,MAAM,QAAQ,eAAe,WAAW,GAAG,GAAG,OAAO,KAAK,EAAE,GACxE;AACA,mBAAa;AAAA,IACf;AACA,mBAAe,aAAa;AAC5B,aAAS;AAAA,EACX;AAEA,MAAI,YAAY;AACd,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,QAAM,eAAe,kBAAkB,CAAC,sBAAsB,GAAG;AAAA,IAC/D,iBAAiB;AAAA,EACnB,CAAC;AAED,MAAI,YAA2B;AAC/B,MAAI,WAA0B;AAC9B,MAAI,YAA2B;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,QAAQ,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,MAAM,YAAY,MAAM,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,MAAI,MAAM;AACR,eAAW,KAAK,MAAM,KAAK,KAAK;AAChC,gBAAY,KAAK,SAAS;AAC1B,iBAAa,YAAY,SAAS,SAAS,IAAI,WAAW,cAAc;AAAA,EAC1E;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM;AAAA,EACpB;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,MAAM;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,MACP,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS,eAAe,IAAI,CAAC,YAAY;AAAA,MACvC,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAM,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjG,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,MAAM;AAAA,IACN,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,OAAO,OAAO,KAAK,MAAM;AAAA,EAC9C,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,eAAe;AAOrC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU;AAErC,QAAM,eAAe,OAAO,KAAK;AACjC,QAAM,YAAY,aACf,IAAI,CAAC,MAAM,WAAW;AAAA,IACrB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,OAAO;AAAA,IACP,UAAU;AAAA,IACV,MAAM,KAAK,QAAQ;AAAA,IACnB,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS,WAAW,IAAI,KAAK,QAAQ,CAAC;AAEjD,QAAM,YAAY,IAAI,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC1D,MAAI,UAAU,SAAS,UAAU,QAAQ;AACvC,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,iBAAiB;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,aAAa;AAAA,EACtB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mBAAmB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,sBAAsB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,IAClG,EAAE,QAAQ,KAAK,aAAa,+DAA0D,QAAQ,sBAAsB;AAAA,EACtH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/dashboards/lib/widgets.js

@@ -7,7 +7,7 @@ function invalidateWidgetCache() {
 }
 async function loadWidgetEntries() {
   if (!widgetEntriesPromise) {
-    widgetEntriesPromise = Promise.resolve().then(() => {
+    const pending = Promise.resolve().then(() => {
       const list = getModules();
       const entries = list.flatMap((mod) => {
         const moduleEntries = mod.dashboardWidgets ?? [];
@@ -18,6 +18,20 @@ async function loadWidgetEntries() {
       });
       return applyDashboardWidgetOverridesToEntries(entries);
     });
+    widgetEntriesPromise = pending;
+    const forgetWhenUnusable = (entries) => {
+      if (widgetEntriesPromise === pending && (entries === null || entries.length === 0)) {
+        widgetEntriesPromise = null;
+      }
+    };
+    try {
+      const entries = await pending;
+      forgetWhenUnusable(entries);
+      return entries;
+    } catch (err) {
+      forgetWhenUnusable(null);
+      throw err;
+    }
   }
   return widgetEntriesPromise;
 }
@@ -49,6 +63,9 @@ async function loadEntry(entry) {
   if (!widgetCache.has(entry.key)) {
     const promise = entry.loader().then((mod) => ensureValidWidgetModule(mod, entry.key, entry.moduleId));
     widgetCache.set(entry.key, promise);
+    promise.catch(() => {
+      if (widgetCache.get(entry.key) === promise) widgetCache.delete(entry.key);
+    });
   }
   return widgetCache.get(entry.key);
 }

package/dist/modules/dashboards/lib/widgets.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dashboards/lib/widgets.ts"],
-  "sourcesContent": ["import type { Module, ModuleDashboardWidgetEntry } from '@open-mercato/shared/modules/registry'\nimport type { DashboardWidgetMetadata, DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'\nimport { applyDashboardWidgetOverridesToEntries } from '@open-mercato/shared/modules/overrides'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\n\ntype LoadedWidgetModule = DashboardWidgetModule<any> & { metadata: DashboardWidgetMetadata }\n\ntype WidgetEntry = ModuleDashboardWidgetEntry & { moduleId: string }\n\nlet widgetEntriesPromise: Promise<WidgetEntry[]> | null = null\n\n/**\n * Invalidate the widget entries and widget module cache.\n * Call this when the generated registry is updated or modules are reloaded.\n */\nexport function invalidateWidgetCache() {\n  widgetEntriesPromise = null;\n  widgetCache.clear();\n}\nasync function loadWidgetEntries(): Promise<WidgetEntry[]> {\n  if (!widgetEntriesPromise) {\n    widgetEntriesPromise = Promise.resolve().then(() => {\n      const list = getModules() as Module[]\n      const entries = list.flatMap((mod) => {\n        const moduleEntries = mod.dashboardWidgets ?? []\n        return moduleEntries.map((entry) => ({\n          ...entry,\n          moduleId: mod.id,\n        }))\n      })\n      return applyDashboardWidgetOverridesToEntries(entries) as WidgetEntry[]\n    })\n  }\n  return widgetEntriesPromise\n}\n\nconst widgetCache = new Map<string, Promise<LoadedWidgetModule>>()\n\nfunction ensureValidWidgetModule(mod: any, key: string, moduleId: string): LoadedWidgetModule {\n  if (!mod || typeof mod !== 'object') {\n    throw new Error(`Invalid dashboard widget module \"${key}\" from \"${moduleId}\" (expected object export)`)\n  }\n  const widget = (mod.default ?? mod) as DashboardWidgetModule<any>\n  if (!widget || typeof widget !== 'object') {\n    throw new Error(`Invalid dashboard widget export \"${key}\" from \"${moduleId}\" (missing default export)`)\n  }\n  if (!widget.metadata || typeof widget.metadata !== 'object') {\n    throw new Error(`Dashboard widget \"${key}\" from \"${moduleId}\" is missing metadata`)\n  }\n  const { metadata } = widget\n  if (typeof metadata.id !== 'string' || metadata.id.length === 0) {\n    throw new Error(`Dashboard widget \"${key}\" from \"${moduleId}\" metadata.id must be a non-empty string`)\n  }\n  if (typeof metadata.title !== 'string' || metadata.title.length === 0) {\n    throw new Error(`Dashboard widget \"${metadata.id}\" from \"${moduleId}\" must have a title`)\n  }\n  return {\n    ...widget,\n    metadata,\n  }\n}\n\nasync function loadEntry(entry: WidgetEntry): Promise<LoadedWidgetModule> {\n  if (!widgetCache.has(entry.key)) {\n    const promise = entry.loader()\n      .then((mod) => ensureValidWidgetModule(mod, entry.key, entry.moduleId))\n    widgetCache.set(entry.key, promise)\n  }\n  return widgetCache.get(entry.key)!\n}\n\nexport async function loadAllWidgets(): Promise<Array<LoadedWidgetModule & { moduleId: string; key: string }>> {\n  const widgetEntries = await loadWidgetEntries()\n  const loaded = await Promise.all(widgetEntries.map(async (entry) => {\n    const widget = await loadEntry(entry)\n    return { ...widget, moduleId: entry.moduleId, key: entry.key }\n  }))\n  const byId = new Map<string, LoadedWidgetModule & { moduleId: string; key: string }>()\n  for (const widget of loaded) {\n    if (!byId.has(widget.metadata.id)) {\n      byId.set(widget.metadata.id, widget)\n    }\n  }\n  return Array.from(byId.values())\n}\n\nexport async function loadWidgetById(widgetId: string): Promise<(LoadedWidgetModule & { moduleId: string; key: string }) | null> {\n  const widgetEntries = await loadWidgetEntries()\n  for (const entry of widgetEntries) {\n    const widget = await loadEntry(entry)\n    if (widget.metadata.id === widgetId) {\n      return { ...widget, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n"],
-  "mappings": "AAEA,SAAS,8CAA8C;AACvD,SAAS,kBAAkB;AAM3B,IAAI,uBAAsD;AAMnD,SAAS,wBAAwB;AACtC,yBAAuB;AACvB,cAAY,MAAM;AACpB;AACA,eAAe,oBAA4C;AACzD,MAAI,CAAC,sBAAsB;AACzB,2BAAuB,QAAQ,QAAQ,EAAE,KAAK,MAAM;AAClD,YAAM,OAAO,WAAW;AACxB,YAAM,UAAU,KAAK,QAAQ,CAAC,QAAQ;AACpC,cAAM,gBAAgB,IAAI,oBAAoB,CAAC;AAC/C,eAAO,cAAc,IAAI,CAAC,WAAW;AAAA,UACnC,GAAG;AAAA,UACH,UAAU,IAAI;AAAA,QAChB,EAAE;AAAA,MACJ,CAAC;AACD,aAAO,uCAAuC,OAAO;AAAA,IACvD,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,MAAM,cAAc,oBAAI,IAAyC;AAEjE,SAAS,wBAAwB,KAAU,KAAa,UAAsC;AAC5F,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,QAAM,SAAU,IAAI,WAAW;AAC/B,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,MAAI,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,UAAU;AAC3D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,uBAAuB;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI;AACrB,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,0CAA0C;AAAA,EACvG;AACA,MAAI,OAAO,SAAS,UAAU,YAAY,SAAS,MAAM,WAAW,GAAG;AACrE,UAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,WAAW,QAAQ,qBAAqB;AAAA,EAC1F;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,UAAU,OAAiD;AACxE,MAAI,CAAC,YAAY,IAAI,MAAM,GAAG,GAAG;AAC/B,UAAM,UAAU,MAAM,OAAO,EAC1B,KAAK,CAAC,QAAQ,wBAAwB,KAAK,MAAM,KAAK,MAAM,QAAQ,CAAC;AACxE,gBAAY,IAAI,MAAM,KAAK,OAAO;AAAA,EACpC;AACA,SAAO,YAAY,IAAI,MAAM,GAAG;AAClC;AAEA,eAAsB,iBAAyF;AAC7G,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,SAAS,MAAM,QAAQ,IAAI,cAAc,IAAI,OAAO,UAAU;AAClE,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,WAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,EAC/D,CAAC,CAAC;AACF,QAAM,OAAO,oBAAI,IAAoE;AACrF,aAAW,UAAU,QAAQ;AAC3B,QAAI,CAAC,KAAK,IAAI,OAAO,SAAS,EAAE,GAAG;AACjC,WAAK,IAAI,OAAO,SAAS,IAAI,MAAM;AAAA,IACrC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AACjC;AAEA,eAAsB,eAAe,UAA4F;AAC/H,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["import type { Module, ModuleDashboardWidgetEntry } from '@open-mercato/shared/modules/registry'\nimport type { DashboardWidgetMetadata, DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'\nimport { applyDashboardWidgetOverridesToEntries } from '@open-mercato/shared/modules/overrides'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\n\ntype LoadedWidgetModule = DashboardWidgetModule<any> & { metadata: DashboardWidgetMetadata }\n\ntype WidgetEntry = ModuleDashboardWidgetEntry & { moduleId: string }\n\nlet widgetEntriesPromise: Promise<WidgetEntry[]> | null = null\n\n/**\n * Invalidate the widget entries and widget module cache.\n * Call this when the generated registry is updated or modules are reloaded.\n */\nexport function invalidateWidgetCache() {\n  widgetEntriesPromise = null;\n  widgetCache.clear();\n}\n/**\n * An empty resolution means the module registry was not populated yet \u2014 a boot\n * race, not \"this app has no dashboard widgets\". Memoizing it would serve an\n * empty registry for the lifetime of the process, so the entry is dropped and\n * the next call retries. A rejected resolution is dropped for the same reason.\n */\nasync function loadWidgetEntries(): Promise<WidgetEntry[]> {\n  if (!widgetEntriesPromise) {\n    const pending = Promise.resolve().then(() => {\n      const list = getModules() as Module[]\n      const entries = list.flatMap((mod) => {\n        const moduleEntries = mod.dashboardWidgets ?? []\n        return moduleEntries.map((entry) => ({\n          ...entry,\n          moduleId: mod.id,\n        }))\n      })\n      return applyDashboardWidgetOverridesToEntries(entries) as WidgetEntry[]\n    })\n    widgetEntriesPromise = pending\n    const forgetWhenUnusable = (entries: WidgetEntry[] | null) => {\n      if (widgetEntriesPromise === pending && (entries === null || entries.length === 0)) {\n        widgetEntriesPromise = null\n      }\n    }\n    try {\n      const entries = await pending\n      forgetWhenUnusable(entries)\n      return entries\n    } catch (err) {\n      forgetWhenUnusable(null)\n      throw err\n    }\n  }\n  return widgetEntriesPromise\n}\n\nconst widgetCache = new Map<string, Promise<LoadedWidgetModule>>()\n\nfunction ensureValidWidgetModule(mod: any, key: string, moduleId: string): LoadedWidgetModule {\n  if (!mod || typeof mod !== 'object') {\n    throw new Error(`Invalid dashboard widget module \"${key}\" from \"${moduleId}\" (expected object export)`)\n  }\n  const widget = (mod.default ?? mod) as DashboardWidgetModule<any>\n  if (!widget || typeof widget !== 'object') {\n    throw new Error(`Invalid dashboard widget export \"${key}\" from \"${moduleId}\" (missing default export)`)\n  }\n  if (!widget.metadata || typeof widget.metadata !== 'object') {\n    throw new Error(`Dashboard widget \"${key}\" from \"${moduleId}\" is missing metadata`)\n  }\n  const { metadata } = widget\n  if (typeof metadata.id !== 'string' || metadata.id.length === 0) {\n    throw new Error(`Dashboard widget \"${key}\" from \"${moduleId}\" metadata.id must be a non-empty string`)\n  }\n  if (typeof metadata.title !== 'string' || metadata.title.length === 0) {\n    throw new Error(`Dashboard widget \"${metadata.id}\" from \"${moduleId}\" must have a title`)\n  }\n  return {\n    ...widget,\n    metadata,\n  }\n}\n\nasync function loadEntry(entry: WidgetEntry): Promise<LoadedWidgetModule> {\n  if (!widgetCache.has(entry.key)) {\n    const promise = entry.loader()\n      .then((mod) => ensureValidWidgetModule(mod, entry.key, entry.moduleId))\n    widgetCache.set(entry.key, promise)\n    // Same policy as the entries cache above: a rejected resolution is a transient\n    // failure (a dynamic import that lost a race), not a permanent fact about the\n    // widget. Memoizing it would make loadAllWidgets() reject for the lifetime of the\n    // process. The identity check mirrors `widgetEntriesPromise === pending`, so a\n    // concurrent invalidateWidgetCache() is never clobbered.\n    promise.catch(() => {\n      if (widgetCache.get(entry.key) === promise) widgetCache.delete(entry.key)\n    })\n  }\n  return widgetCache.get(entry.key)!\n}\n\nexport async function loadAllWidgets(): Promise<Array<LoadedWidgetModule & { moduleId: string; key: string }>> {\n  const widgetEntries = await loadWidgetEntries()\n  const loaded = await Promise.all(widgetEntries.map(async (entry) => {\n    const widget = await loadEntry(entry)\n    return { ...widget, moduleId: entry.moduleId, key: entry.key }\n  }))\n  const byId = new Map<string, LoadedWidgetModule & { moduleId: string; key: string }>()\n  for (const widget of loaded) {\n    if (!byId.has(widget.metadata.id)) {\n      byId.set(widget.metadata.id, widget)\n    }\n  }\n  return Array.from(byId.values())\n}\n\nexport async function loadWidgetById(widgetId: string): Promise<(LoadedWidgetModule & { moduleId: string; key: string }) | null> {\n  const widgetEntries = await loadWidgetEntries()\n  for (const entry of widgetEntries) {\n    const widget = await loadEntry(entry)\n    if (widget.metadata.id === widgetId) {\n      return { ...widget, moduleId: entry.moduleId, key: entry.key }\n    }\n  }\n  return null\n}\n"],
+  "mappings": "AAEA,SAAS,8CAA8C;AACvD,SAAS,kBAAkB;AAM3B,IAAI,uBAAsD;AAMnD,SAAS,wBAAwB;AACtC,yBAAuB;AACvB,cAAY,MAAM;AACpB;AAOA,eAAe,oBAA4C;AACzD,MAAI,CAAC,sBAAsB;AACzB,UAAM,UAAU,QAAQ,QAAQ,EAAE,KAAK,MAAM;AAC3C,YAAM,OAAO,WAAW;AACxB,YAAM,UAAU,KAAK,QAAQ,CAAC,QAAQ;AACpC,cAAM,gBAAgB,IAAI,oBAAoB,CAAC;AAC/C,eAAO,cAAc,IAAI,CAAC,WAAW;AAAA,UACnC,GAAG;AAAA,UACH,UAAU,IAAI;AAAA,QAChB,EAAE;AAAA,MACJ,CAAC;AACD,aAAO,uCAAuC,OAAO;AAAA,IACvD,CAAC;AACD,2BAAuB;AACvB,UAAM,qBAAqB,CAAC,YAAkC;AAC5D,UAAI,yBAAyB,YAAY,YAAY,QAAQ,QAAQ,WAAW,IAAI;AAClF,+BAAuB;AAAA,MACzB;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,MAAM;AACtB,yBAAmB,OAAO;AAC1B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,yBAAmB,IAAI;AACvB,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,cAAc,oBAAI,IAAyC;AAEjE,SAAS,wBAAwB,KAAU,KAAa,UAAsC;AAC5F,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,QAAM,SAAU,IAAI,WAAW;AAC/B,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,UAAM,IAAI,MAAM,oCAAoC,GAAG,WAAW,QAAQ,4BAA4B;AAAA,EACxG;AACA,MAAI,CAAC,OAAO,YAAY,OAAO,OAAO,aAAa,UAAU;AAC3D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,uBAAuB;AAAA,EACpF;AACA,QAAM,EAAE,SAAS,IAAI;AACrB,MAAI,OAAO,SAAS,OAAO,YAAY,SAAS,GAAG,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,qBAAqB,GAAG,WAAW,QAAQ,0CAA0C;AAAA,EACvG;AACA,MAAI,OAAO,SAAS,UAAU,YAAY,SAAS,MAAM,WAAW,GAAG;AACrE,UAAM,IAAI,MAAM,qBAAqB,SAAS,EAAE,WAAW,QAAQ,qBAAqB;AAAA,EAC1F;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,UAAU,OAAiD;AACxE,MAAI,CAAC,YAAY,IAAI,MAAM,GAAG,GAAG;AAC/B,UAAM,UAAU,MAAM,OAAO,EAC1B,KAAK,CAAC,QAAQ,wBAAwB,KAAK,MAAM,KAAK,MAAM,QAAQ,CAAC;AACxE,gBAAY,IAAI,MAAM,KAAK,OAAO;AAMlC,YAAQ,MAAM,MAAM;AAClB,UAAI,YAAY,IAAI,MAAM,GAAG,MAAM,QAAS,aAAY,OAAO,MAAM,GAAG;AAAA,IAC1E,CAAC;AAAA,EACH;AACA,SAAO,YAAY,IAAI,MAAM,GAAG;AAClC;AAEA,eAAsB,iBAAyF;AAC7G,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,QAAM,SAAS,MAAM,QAAQ,IAAI,cAAc,IAAI,OAAO,UAAU;AAClE,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,WAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,EAC/D,CAAC,CAAC;AACF,QAAM,OAAO,oBAAI,IAAoE;AACrF,aAAW,UAAU,QAAQ;AAC3B,QAAI,CAAC,KAAK,IAAI,OAAO,SAAS,EAAE,GAAG;AACjC,WAAK,IAAI,OAAO,SAAS,IAAI,MAAM;AAAA,IACrC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,KAAK,OAAO,CAAC;AACjC;AAEA,eAAsB,eAAe,UAA4F;AAC/H,QAAM,gBAAgB,MAAM,kBAAkB;AAC9C,aAAW,SAAS,eAAe;AACjC,UAAM,SAAS,MAAM,UAAU,KAAK;AACpC,QAAI,OAAO,SAAS,OAAO,UAAU;AACnC,aAAO,EAAE,GAAG,QAAQ,UAAU,MAAM,UAAU,KAAK,MAAM,IAAI;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6899.1.433952fd93",
+  "version": "0.6.8-develop.6903.1.0ec850a22b",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6899.1.433952fd93",
-    "@open-mercato/shared": "0.6.8-develop.6899.1.433952fd93",
-    "@open-mercato/ui": "0.6.8-develop.6899.1.433952fd93",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6903.1.0ec850a22b",
+    "@open-mercato/shared": "0.6.8-develop.6903.1.0ec850a22b",
+    "@open-mercato/ui": "0.6.8-develop.6903.1.0ec850a22b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6899.1.433952fd93",
-    "@open-mercato/shared": "0.6.8-develop.6899.1.433952fd93",
-    "@open-mercato/ui": "0.6.8-develop.6899.1.433952fd93",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6903.1.0ec850a22b",
+    "@open-mercato/shared": "0.6.8-develop.6903.1.0ec850a22b",
+    "@open-mercato/ui": "0.6.8-develop.6903.1.0ec850a22b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -6,6 +6,7 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import type { AwilixContainer } from 'awilix'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -120,6 +121,12 @@ export async function POST(req: Request) {
     await commandBus.undo(undoToken, ctx)
     return NextResponse.json({ ok: true, logId: target.id })
   } catch (err) {
+    // A beforeUndo interceptor that blocked with an explicit status is a deliberate business
+    // rejection, not an undo failure — surface its status and message (issue #5045).
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('Undo failed', { err })
     return NextResponse.json({ error: 'Undo failed' }, { status: 400 })
   }
@@ -156,6 +163,12 @@ export const openApi: OpenApiRouteDoc = {
         { status: 400, description: 'Invalid or unavailable undo token', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
         { status: 403, description: 'Undo blocked by organization or tenant scope', schema: errorSchema },
+        {
+          status: 422,
+          description:
+            'Undo deliberately blocked by a beforeUndo command interceptor. The interceptor chooses the status (any 4xx/5xx) and may replace the body.',
+          schema: errorSchema,
+        },
       ],
     },
   },

package/src/modules/dashboards/api/layout/route.ts

@@ -106,6 +106,14 @@ export async function GET(req: Request) {
   )
   const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id))
 
+  // An empty widget registry means the module registry has not been populated yet
+  // (a boot race), not that this app has no widgets. Every write below is derived
+  // from it, so a read request must persist nothing until it recovers — otherwise a
+  // restart-recoverable glitch is written into saved layouts for good (#5041).
+  // Note this keys off the registry, not off `allowedIds`: a user whose allowlist is
+  // legitimately empty on a healthy registry is still pruned and seeded as before.
+  const hasRegisteredWidgets = widgets.length > 0
+
   let layout = await loadScopeLayout(em, scope)
   let items = layout ? normalizeLayoutItems(layout.layoutJson) : []
   let hasChanged = false
@@ -120,15 +128,17 @@ export async function GET(req: Request) {
       size: widget.metadata.defaultSize ?? DEFAULT_SIZE,
       settings: widget.metadata.defaultSettings ?? undefined,
     }))
-    layout = em.create(DashboardLayout, {
-      userId: scope.userId,
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      layoutJson: items,
-    })
-    em.persist(layout)
-    hasChanged = true
-  } else {
+    if (hasRegisteredWidgets) {
+      layout = em.create(DashboardLayout, {
+        userId: scope.userId,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        layoutJson: items,
+      })
+      em.persist(layout)
+      hasChanged = true
+    }
+  } else if (hasRegisteredWidgets) {
     const existingLayout = layout
     const filtered = items.filter((item) => allowedIds.includes(item.widgetId))
     if (filtered.length !== items.length) {
@@ -252,6 +262,15 @@ export async function PUT(req: Request) {
   }
 
   const widgets = await loadAllWidgets()
+  // The allowlist below is derived from the registry, and this handler persists the
+  // filtered result unconditionally. An empty registry — the boot race behind #5041 —
+  // would drop every submitted item and save `[]` while answering `{ ok: true }`, so a
+  // stale tab reordering a widget could erase the layout it just rendered. Fail the
+  // write instead: the save is explicit, so the client must learn it did not happen
+  // and retry, rather than be told a wipe succeeded.
+  if (widgets.length === 0) {
+    return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })
+  }
   const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
@@ -349,6 +368,7 @@ const layoutPutDoc: OpenApiMethodDoc = {
     { status: 400, description: 'Invalid layout payload', schema: dashboardsErrorSchema },
     { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },
     { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },
+    { status: 503, description: 'Widget registry unavailable — the layout was not saved', schema: dashboardsErrorSchema },
   ],
 }
 

package/src/modules/dashboards/lib/widgets.ts

@@ -17,9 +17,15 @@ export function invalidateWidgetCache() {
   widgetEntriesPromise = null;
   widgetCache.clear();
 }
+/**
+ * An empty resolution means the module registry was not populated yet — a boot
+ * race, not "this app has no dashboard widgets". Memoizing it would serve an
+ * empty registry for the lifetime of the process, so the entry is dropped and
+ * the next call retries. A rejected resolution is dropped for the same reason.
+ */
 async function loadWidgetEntries(): Promise<WidgetEntry[]> {
   if (!widgetEntriesPromise) {
-    widgetEntriesPromise = Promise.resolve().then(() => {
+    const pending = Promise.resolve().then(() => {
       const list = getModules() as Module[]
       const entries = list.flatMap((mod) => {
         const moduleEntries = mod.dashboardWidgets ?? []
@@ -30,6 +36,20 @@ async function loadWidgetEntries(): Promise<WidgetEntry[]> {
       })
       return applyDashboardWidgetOverridesToEntries(entries) as WidgetEntry[]
     })
+    widgetEntriesPromise = pending
+    const forgetWhenUnusable = (entries: WidgetEntry[] | null) => {
+      if (widgetEntriesPromise === pending && (entries === null || entries.length === 0)) {
+        widgetEntriesPromise = null
+      }
+    }
+    try {
+      const entries = await pending
+      forgetWhenUnusable(entries)
+      return entries
+    } catch (err) {
+      forgetWhenUnusable(null)
+      throw err
+    }
   }
   return widgetEntriesPromise
 }
@@ -65,6 +85,14 @@ async function loadEntry(entry: WidgetEntry): Promise<LoadedWidgetModule> {
     const promise = entry.loader()
       .then((mod) => ensureValidWidgetModule(mod, entry.key, entry.moduleId))
     widgetCache.set(entry.key, promise)
+    // Same policy as the entries cache above: a rejected resolution is a transient
+    // failure (a dynamic import that lost a race), not a permanent fact about the
+    // widget. Memoizing it would make loadAllWidgets() reject for the lifetime of the
+    // process. The identity check mirrors `widgetEntriesPromise === pending`, so a
+    // concurrent invalidateWidgetCache() is never clobbered.
+    promise.catch(() => {
+      if (widgetCache.get(entry.key) === promise) widgetCache.delete(entry.key)
+    })
   }
   return widgetCache.get(entry.key)!
 }