@open-mercato/core 0.6.8-develop.7072.1.19c2a8bbe0 → 0.6.8-develop.7076.1.13d0af067b

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4337 entry points
+[build:core] found 4341 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/login.js

@@ -175,13 +175,16 @@ async function POST(req) {
   const interceptedBody = interceptedResponse.body;
   const authTokenForCookie = typeof interceptedBody.token === "string" && interceptedBody.token.length > 0 ? interceptedBody.token : token;
   const refreshTokenForCookie = typeof interceptedBody.refreshToken === "string" ? interceptedBody.refreshToken : void 0;
+  const authTokenReplacedByInterceptor = authTokenForCookie !== token;
   const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode });
   res.cookies.set("auth_token", authTokenForCookie, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: accessTokenMaxAgeSeconds });
   if (remember && refreshTokenForCookie) {
     const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1e3);
     res.cookies.set("session_token", refreshTokenForCookie, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", expires: expiresAt });
-  } else if (!remember && authTokenForCookie === token) {
+  } else if (!remember && !authTokenReplacedByInterceptor) {
     res.cookies.set("session_token", sessionRefreshToken, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: accessTokenMaxAgeSeconds });
+  } else if (authTokenReplacedByInterceptor) {
+    res.cookies.set("session_token", "", { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: 0 });
   }
   return res;
 }

package/dist/modules/auth/api/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok || user.isConfirmed === false) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && authTokenForCookie === token) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAE9B,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,OAAO;AAK9C,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAEJ,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,uBAAuB,OAAO;AACpD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok || user.isConfirmed === false) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional\n  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the\n  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff\n  // token and skip the outstanding second factor, so it is cleared alongside the swap.\n  const authTokenReplacedByInterceptor = authTokenForCookie !== token\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && !authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  } else if (authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAE9B,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,OAAO;AAK9C,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAMJ,QAAM,iCAAiC,uBAAuB;AAE9D,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,CAAC,gCAAgC;AACvD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL,WAAW,gCAAgC;AACzC,QAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,EAAE,CAAC;AAAA,EAC/I;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": ["requireRoleRaw", "userRoleNames"]
 }

package/dist/modules/auth/api/session/refresh.js

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import { signJwt } from "@open-mercato/shared/lib/auth/jwt";
+import { isMfaPendingJwtPayload, signJwt, verifyJwt } from "@open-mercato/shared/lib/auth/jwt";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { refreshSessionRequestSchema } from "@open-mercato/core/modules/auth/data/validators";
 import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
@@ -26,6 +26,17 @@ function parseCookie(req, name) {
   const m = cookie.match(new RegExp("(?:^|;\\s*)" + name + "=([^;]+)"));
   return m ? decodeURIComponent(m[1]) : null;
 }
+function carriesMfaPendingToken(req) {
+  const authHeader = (req.headers.get("authorization") || "").trim();
+  const bearer = authHeader.toLowerCase().startsWith("bearer ") ? authHeader.slice(7).trim() : null;
+  const token = bearer || parseCookie(req, "auth_token");
+  if (!token) return false;
+  try {
+    return isMfaPendingJwtPayload(verifyJwt(token));
+  } catch {
+    return false;
+  }
+}
 function buildStaffJwtClaims({ user, roles, session }) {
   return {
     sub: String(user.id),
@@ -57,6 +68,11 @@ async function GET(req) {
   const url = new URL(req.url);
   const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin;
   const redirectTo = sanitizeRedirectPath(url.searchParams.get("redirect"), baseUrl, "/");
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      buildSafeRedirectResponse(req, "/login?redirect=" + encodeURIComponent(redirectTo))
+    );
+  }
   const token = parseCookie(req, "session_token");
   if (!token) {
     return clearStaffAuthCookies(
@@ -94,6 +110,14 @@ async function POST(req) {
     compoundIdentifier: token ?? void 0
   });
   if (rateLimitError) return rateLimitError;
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      NextResponse.json({
+        ok: false,
+        error: translate("auth.session.refresh.errors.invalidToken", "Invalid or expired refresh token")
+      }, { status: 401 })
+    );
+  }
   if (!token) {
     return clearStaffAuthCookies(
       NextResponse.json({

package/dist/modules/auth/api/session/refresh.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/session/refresh.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { refreshSessionRequestSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { z } from 'zod'\n\nconst refreshRateLimitConfig = readEndpointRateLimitConfig('REFRESH', {\n  points: 15, duration: 60, blockDuration: 60, keyPrefix: 'refresh',\n})\nconst refreshIpRateLimitConfig = readEndpointRateLimitConfig('REFRESH_IP', {\n  points: 60, duration: 60, blockDuration: 60, keyPrefix: 'refresh-ip',\n})\n\nfunction parseCookie(req: Request, name: string): string | null {\n  const cookie = req.headers.get('cookie') || ''\n  const m = cookie.match(new RegExp('(?:^|;\\\\s*)' + name + '=([^;]+)'))\n  return m ? decodeURIComponent(m[1]) : null\n}\n\ntype RefreshedSession = NonNullable<Awaited<ReturnType<AuthService['refreshFromSessionToken']>>>\n\n// Scope claims must stay absent rather than stringified when the user has no tenant/org:\n// `String(null)` yields the literal \"null\", which is not a UUID, so session-integrity\n// resolution rejects the token it just minted and the caller is stuck in a refresh loop.\n// Mirrors how `api/login.ts` builds the same claims.\nfunction buildStaffJwtClaims({ user, roles, session }: RefreshedSession) {\n  return {\n    sub: String(user.id),\n    sid: session ? String(session.id) : undefined,\n    tenantId: user.tenantId ? String(user.tenantId) : null,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles,\n  }\n}\n\nfunction clearStaffAuthCookies(response: NextResponse) {\n  response.cookies.set('auth_token', '', {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 0,\n  })\n  response.cookies.set('session_token', '', {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 0,\n  })\n  return response\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin\n  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/')\n  const token = parseCookie(req, 'session_token')\n  if (!token) {\n    return clearStaffAuthCookies(\n      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))\n    )\n  }\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const ctx = await auth.refreshFromSessionToken(token)\n  if (!ctx) {\n    return clearStaffAuthCookies(\n      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))\n    )\n  }\n  const jwt = signJwt(buildStaffJwtClaims(ctx))\n  const res = buildSafeRedirectResponse(req, redirectTo)\n  res.cookies.set('auth_token', jwt, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 60 * 60 * 8 })\n  return res\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  let token: string | null = null\n\n  try {\n    const body = await req.json()\n    const parsed = refreshSessionRequestSchema.safeParse(body)\n    if (parsed.success) {\n      token = parsed.data.refreshToken\n    }\n  } catch {\n    // Invalid JSON\n  }\n\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: refreshIpRateLimitConfig,\n    compoundConfig: refreshRateLimitConfig,\n    compoundIdentifier: token ?? undefined,\n  })\n  if (rateLimitError) return rateLimitError\n\n  if (!token) {\n    return clearStaffAuthCookies(\n      NextResponse.json({\n        ok: false,\n        error: translate('auth.session.refresh.errors.invalidPayload', 'Missing or invalid refresh token'),\n      }, { status: 400 })\n    )\n  }\n\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const ctx = await auth.refreshFromSessionToken(token)\n\n  if (!ctx) {\n    return clearStaffAuthCookies(\n      NextResponse.json({\n        ok: false,\n        error: translate('auth.session.refresh.errors.invalidToken', 'Invalid or expired refresh token'),\n      }, { status: 401 })\n    )\n  }\n\n  const jwt = signJwt(buildStaffJwtClaims(ctx))\n\n  const res = NextResponse.json({\n    ok: true,\n    accessToken: jwt,\n    expiresIn: 60 * 60 * 8,\n  })\n\n  res.cookies.set('auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n\n  return res\n}\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  POST: { requireAuth: false },\n}\n\nconst refreshQuerySchema = z.object({\n  redirect: z.string().optional().describe('Absolute or relative URL to redirect after refresh'),\n})\n\nconst refreshSuccessSchema = z.object({\n  ok: z.literal(true),\n  accessToken: z.string().describe('New JWT access token'),\n  expiresIn: z.number().describe('Token expiration time in seconds'),\n})\n\nconst refreshErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Refresh session token',\n  methods: {\n    GET: {\n      summary: 'Refresh auth cookie from session token (browser)',\n      description: 'Exchanges an existing `session_token` cookie for a fresh JWT auth cookie and redirects the browser.',\n      query: refreshQuerySchema,\n      responses: [\n        { status: 302, description: 'Redirect to target location when session is valid', mediaType: 'text/html' },\n      ],\n    },\n    POST: {\n      summary: 'Refresh access token (API/mobile)',\n      description: 'Exchanges a refresh token for a new JWT access token. Pass the refresh token obtained from login in the request body.',\n      requestBody: { schema: refreshSessionRequestSchema, contentType: 'application/json' },\n      responses: [\n        { status: 200, description: 'New access token issued', schema: refreshSuccessSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing refresh token', schema: refreshErrorSchema },\n        { status: 401, description: 'Invalid or expired token', schema: refreshErrorSchema },\n        { status: 429, description: 'Too many refresh attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,MAAM,yBAAyB,4BAA4B,WAAW;AAAA,EACpE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AACD,MAAM,2BAA2B,4BAA4B,cAAc;AAAA,EACzE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAED,SAAS,YAAY,KAAc,MAA6B;AAC9D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC5C,QAAM,IAAI,OAAO,MAAM,IAAI,OAAO,gBAAgB,OAAO,UAAU,CAAC;AACpE,SAAO,IAAI,mBAAmB,EAAE,CAAC,CAAC,IAAI;AACxC;AAQA,SAAS,oBAAoB,EAAE,MAAM,OAAO,QAAQ,GAAqB;AACvE,SAAO;AAAA,IACL,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,UAAU,OAAO,QAAQ,EAAE,IAAI;AAAA,IACpC,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,IAClD,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAAwB;AACrD,WAAS,QAAQ,IAAI,cAAc,IAAI;AAAA,IACrC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,WAAS,QAAQ,IAAI,iBAAiB,IAAI;AAAA,IACxC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,2BAA2B,GAAG,KAAK,IAAI;AACvD,QAAM,aAAa,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,GAAG;AACtF,QAAM,QAAQ,YAAY,KAAK,eAAe;AAC9C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,0BAA0B,KAAK,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,MAAM,MAAM,KAAK,wBAAwB,KAAK;AACpD,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,0BAA0B,KAAK,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,oBAAoB,GAAG,CAAC;AAC5C,QAAM,MAAM,0BAA0B,KAAK,UAAU;AACrD,MAAI,QAAQ,IAAI,cAAc,KAAK,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,KAAK,KAAK,EAAE,CAAC;AACrJ,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,QAAuB;AAE3B,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,4BAA4B,UAAU,IAAI;AACzD,QAAI,OAAO,SAAS;AAClB,cAAQ,OAAO,KAAK;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB,SAAS;AAAA,EAC/B,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,UAAU,8CAA8C,kCAAkC;AAAA,MACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,MAAM,MAAM,KAAK,wBAAwB,KAAK;AAEpD,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,UAAU,4CAA4C,kCAAkC;AAAA,MACjG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,oBAAoB,GAAG,CAAC;AAE5C,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,WAAW,KAAK,KAAK;AAAA,EACvB,CAAC;AAED,MAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AAED,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAC/F,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,aAAa,EAAE,OAAO,EAAE,SAAS,sBAAsB;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AACnE,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qDAAqD,WAAW,YAAY;AAAA,MAC1G;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,6BAA6B,aAAa,mBAAmB;AAAA,MACpF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,mBAAmB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,mBAAmB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,qBAAqB;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { isMfaPendingJwtPayload, signJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { refreshSessionRequestSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { z } from 'zod'\n\nconst refreshRateLimitConfig = readEndpointRateLimitConfig('REFRESH', {\n  points: 15, duration: 60, blockDuration: 60, keyPrefix: 'refresh',\n})\nconst refreshIpRateLimitConfig = readEndpointRateLimitConfig('REFRESH_IP', {\n  points: 60, duration: 60, blockDuration: 60, keyPrefix: 'refresh-ip',\n})\n\nfunction parseCookie(req: Request, name: string): string | null {\n  const cookie = req.headers.get('cookie') || ''\n  const m = cookie.match(new RegExp('(?:^|;\\\\s*)' + name + '=([^;]+)'))\n  return m ? decodeURIComponent(m[1]) : null\n}\n\n// Both handlers are `requireAuth: false`, so the dispatcher's MFA-pending gate never inspects\n// this route's caller. Minting a full staff JWT for a browser that is still holding a provisional\n// `mfa_pending` token would hand it the access the outstanding second factor is meant to withhold,\n// so the pending credential is checked here directly. `refreshFromSessionToken` itself has no MFA\n// awareness \u2014 it validates only the token hash and expiry.\nfunction carriesMfaPendingToken(req: Request): boolean {\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  const bearer = authHeader.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null\n  const token = bearer || parseCookie(req, 'auth_token')\n  if (!token) return false\n  try {\n    return isMfaPendingJwtPayload(verifyJwt(token))\n  } catch {\n    return false\n  }\n}\n\ntype RefreshedSession = NonNullable<Awaited<ReturnType<AuthService['refreshFromSessionToken']>>>\n\n// Scope claims must stay absent rather than stringified when the user has no tenant/org:\n// `String(null)` yields the literal \"null\", which is not a UUID, so session-integrity\n// resolution rejects the token it just minted and the caller is stuck in a refresh loop.\n// Mirrors how `api/login.ts` builds the same claims.\nfunction buildStaffJwtClaims({ user, roles, session }: RefreshedSession) {\n  return {\n    sub: String(user.id),\n    sid: session ? String(session.id) : undefined,\n    tenantId: user.tenantId ? String(user.tenantId) : null,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles,\n  }\n}\n\nfunction clearStaffAuthCookies(response: NextResponse) {\n  response.cookies.set('auth_token', '', {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 0,\n  })\n  response.cookies.set('session_token', '', {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 0,\n  })\n  return response\n}\n\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin\n  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/')\n  if (carriesMfaPendingToken(req)) {\n    return clearStaffAuthCookies(\n      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))\n    )\n  }\n  const token = parseCookie(req, 'session_token')\n  if (!token) {\n    return clearStaffAuthCookies(\n      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))\n    )\n  }\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const ctx = await auth.refreshFromSessionToken(token)\n  if (!ctx) {\n    return clearStaffAuthCookies(\n      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))\n    )\n  }\n  const jwt = signJwt(buildStaffJwtClaims(ctx))\n  const res = buildSafeRedirectResponse(req, redirectTo)\n  res.cookies.set('auth_token', jwt, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 60 * 60 * 8 })\n  return res\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  let token: string | null = null\n\n  try {\n    const body = await req.json()\n    const parsed = refreshSessionRequestSchema.safeParse(body)\n    if (parsed.success) {\n      token = parsed.data.refreshToken\n    }\n  } catch {\n    // Invalid JSON\n  }\n\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: refreshIpRateLimitConfig,\n    compoundConfig: refreshRateLimitConfig,\n    compoundIdentifier: token ?? undefined,\n  })\n  if (rateLimitError) return rateLimitError\n\n  if (carriesMfaPendingToken(req)) {\n    return clearStaffAuthCookies(\n      NextResponse.json({\n        ok: false,\n        error: translate('auth.session.refresh.errors.invalidToken', 'Invalid or expired refresh token'),\n      }, { status: 401 })\n    )\n  }\n\n  if (!token) {\n    return clearStaffAuthCookies(\n      NextResponse.json({\n        ok: false,\n        error: translate('auth.session.refresh.errors.invalidPayload', 'Missing or invalid refresh token'),\n      }, { status: 400 })\n    )\n  }\n\n  const c = await createRequestContainer()\n  const auth = c.resolve<AuthService>('authService')\n  const ctx = await auth.refreshFromSessionToken(token)\n\n  if (!ctx) {\n    return clearStaffAuthCookies(\n      NextResponse.json({\n        ok: false,\n        error: translate('auth.session.refresh.errors.invalidToken', 'Invalid or expired refresh token'),\n      }, { status: 401 })\n    )\n  }\n\n  const jwt = signJwt(buildStaffJwtClaims(ctx))\n\n  const res = NextResponse.json({\n    ok: true,\n    accessToken: jwt,\n    expiresIn: 60 * 60 * 8,\n  })\n\n  res.cookies.set('auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n\n  return res\n}\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  POST: { requireAuth: false },\n}\n\nconst refreshQuerySchema = z.object({\n  redirect: z.string().optional().describe('Absolute or relative URL to redirect after refresh'),\n})\n\nconst refreshSuccessSchema = z.object({\n  ok: z.literal(true),\n  accessToken: z.string().describe('New JWT access token'),\n  expiresIn: z.number().describe('Token expiration time in seconds'),\n})\n\nconst refreshErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Refresh session token',\n  methods: {\n    GET: {\n      summary: 'Refresh auth cookie from session token (browser)',\n      description: 'Exchanges an existing `session_token` cookie for a fresh JWT auth cookie and redirects the browser.',\n      query: refreshQuerySchema,\n      responses: [\n        { status: 302, description: 'Redirect to target location when session is valid', mediaType: 'text/html' },\n      ],\n    },\n    POST: {\n      summary: 'Refresh access token (API/mobile)',\n      description: 'Exchanges a refresh token for a new JWT access token. Pass the refresh token obtained from login in the request body.',\n      requestBody: { schema: refreshSessionRequestSchema, contentType: 'application/json' },\n      responses: [\n        { status: 200, description: 'New access token issued', schema: refreshSuccessSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing refresh token', schema: refreshErrorSchema },\n        { status: 401, description: 'Invalid or expired token', schema: refreshErrorSchema },\n        { status: 429, description: 'Too many refresh attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,wBAAwB,SAAS,iBAAiB;AAC3D,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AACrC,SAAS,SAAS;AAElB,MAAM,yBAAyB,4BAA4B,WAAW;AAAA,EACpE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AACD,MAAM,2BAA2B,4BAA4B,cAAc;AAAA,EACzE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAED,SAAS,YAAY,KAAc,MAA6B;AAC9D,QAAM,SAAS,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC5C,QAAM,IAAI,OAAO,MAAM,IAAI,OAAO,gBAAgB,OAAO,UAAU,CAAC;AACpE,SAAO,IAAI,mBAAmB,EAAE,CAAC,CAAC,IAAI;AACxC;AAOA,SAAS,uBAAuB,KAAuB;AACrD,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,QAAM,SAAS,WAAW,YAAY,EAAE,WAAW,SAAS,IAAI,WAAW,MAAM,CAAC,EAAE,KAAK,IAAI;AAC7F,QAAM,QAAQ,UAAU,YAAY,KAAK,YAAY;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,WAAO,uBAAuB,UAAU,KAAK,CAAC;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,EAAE,MAAM,OAAO,QAAQ,GAAqB;AACvE,SAAO;AAAA,IACL,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,UAAU,OAAO,QAAQ,EAAE,IAAI;AAAA,IACpC,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,IAClD,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAAwB;AACrD,WAAS,QAAQ,IAAI,cAAc,IAAI;AAAA,IACrC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,WAAS,QAAQ,IAAI,iBAAiB,IAAI;AAAA,IACxC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,2BAA2B,GAAG,KAAK,IAAI;AACvD,QAAM,aAAa,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,GAAG;AACtF,MAAI,uBAAuB,GAAG,GAAG;AAC/B,WAAO;AAAA,MACL,0BAA0B,KAAK,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,QAAQ,YAAY,KAAK,eAAe;AAC9C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,0BAA0B,KAAK,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,MAAM,MAAM,KAAK,wBAAwB,KAAK;AACpD,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,0BAA0B,KAAK,qBAAqB,mBAAmB,UAAU,CAAC;AAAA,IACpF;AAAA,EACF;AACA,QAAM,MAAM,QAAQ,oBAAoB,GAAG,CAAC;AAC5C,QAAM,MAAM,0BAA0B,KAAK,UAAU;AACrD,MAAI,QAAQ,IAAI,cAAc,KAAK,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,KAAK,KAAK,EAAE,CAAC;AACrJ,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,QAAuB;AAE3B,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,4BAA4B,UAAU,IAAI;AACzD,QAAI,OAAO,SAAS;AAClB,cAAQ,OAAO,KAAK;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB,SAAS;AAAA,EAC/B,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI,uBAAuB,GAAG,GAAG;AAC/B,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,UAAU,4CAA4C,kCAAkC;AAAA,MACjG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AAEA,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,UAAU,8CAA8C,kCAAkC;AAAA,MACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uBAAuB;AACvC,QAAM,OAAO,EAAE,QAAqB,aAAa;AACjD,QAAM,MAAM,MAAM,KAAK,wBAAwB,KAAK;AAEpD,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,aAAa,KAAK;AAAA,QAChB,IAAI;AAAA,QACJ,OAAO,UAAU,4CAA4C,kCAAkC;AAAA,MACjG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,oBAAoB,GAAG,CAAC;AAE5C,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,WAAW,KAAK,KAAK;AAAA,EACvB,CAAC;AAED,MAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AAED,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAC/F,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,aAAa,EAAE,OAAO,EAAE,SAAS,sBAAsB;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,SAAS,kCAAkC;AACnE,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qDAAqD,WAAW,YAAY;AAAA,MAC1G;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,6BAA6B,aAAa,mBAAmB;AAAA,MACpF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,mBAAmB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,mBAAmB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,qBAAqB;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/ai-tools/deals-pack.js

@@ -8,6 +8,11 @@ import {
   CustomerDeal,
   CustomerPipelineStage
 } from "../data/entities.js";
+import {
+  dealClosureOutcomeFromStatus,
+  loadClosurePipelineStageSnapshot
+} from "../lib/closureStage.js";
+import { canonicalDealStatus, isClosedDealStatus } from "../lib/dealStatus.js";
 import {
   assertTenantScope
 } from "./types.js";
@@ -301,34 +306,72 @@ const updateDealStageTool = {
       afterPipelineStageLabel = stage?.label ?? input.toPipelineStageId;
     } else if (input.toStage) {
       afterStatus = input.toStage;
+      const organizationId = deal.organizationId ?? ctx.organizationId ?? null;
+      const outcome = dealClosureOutcomeFromStatus(input.toStage);
+      if (outcome && organizationId) {
+        const terminalStage = await loadClosurePipelineStageSnapshot(em, {
+          pipelineId: deal.pipelineId ?? null,
+          closureOutcome: outcome,
+          tenantId,
+          organizationId
+        });
+        if (terminalStage) {
+          afterPipelineStageId = terminalStage.id;
+          afterPipelineStageLabel = terminalStage.label;
+        }
+      }
     }
     const beforeStatus = deal.status ?? null;
     const beforePipelineStageId = deal.pipelineStageId ?? null;
     const beforePipelineStageLabel = deal.pipelineStage ?? beforePipelineStageId;
+    const beforeClosureOutcome = deal.closureOutcome ?? null;
+    const beforeLossReasonId = deal.lossReasonId ?? null;
+    const beforeLossNotes = deal.lossNotes ?? null;
+    const requestedOutcome = dealClosureOutcomeFromStatus(input.toStage);
+    const clearsClosure = input.toPipelineStageId === void 0 && input.toStage !== void 0 && !requestedOutcome && !isClosedDealStatus(canonicalDealStatus(input.toStage));
+    const afterClosureOutcome = clearsClosure ? null : requestedOutcome ?? beforeClosureOutcome;
+    const closureOutcomeCleared = beforeClosureOutcome !== null && afterClosureOutcome === null;
+    const afterLossReasonId = closureOutcomeCleared ? null : beforeLossReasonId;
+    const afterLossNotes = closureOutcomeCleared ? null : beforeLossNotes;
     return {
       recordId: deal.id,
       entityType: "customers.deal",
       recordVersion: recordVersionFromUpdatedAt(deal.updatedAt),
       before: {
         status: beforeStatus,
-        pipelineStageId: beforePipelineStageId
+        pipelineStageId: beforePipelineStageId,
+        closureOutcome: beforeClosureOutcome,
+        lossReasonId: beforeLossReasonId,
+        lossNotes: beforeLossNotes
       },
       after: {
         status: afterStatus,
-        pipelineStageId: afterPipelineStageId
+        pipelineStageId: afterPipelineStageId,
+        closureOutcome: afterClosureOutcome,
+        lossReasonId: afterLossReasonId,
+        lossNotes: afterLossNotes
       },
       display: {
         fieldLabels: {
           status: "Status",
-          pipelineStageId: "Pipeline stage"
+          pipelineStageId: "Pipeline stage",
+          closureOutcome: "Closure outcome",
+          lossReasonId: "Loss reason",
+          lossNotes: "Loss notes"
         },
         before: {
           ...beforeStatus ? { status: titleStatus(beforeStatus) } : {},
-          ...beforePipelineStageLabel ? { pipelineStageId: beforePipelineStageLabel } : {}
+          ...beforePipelineStageLabel ? { pipelineStageId: beforePipelineStageLabel } : {},
+          ...beforeClosureOutcome ? { closureOutcome: titleStatus(beforeClosureOutcome) } : {},
+          ...beforeLossReasonId ? { lossReasonId: beforeLossReasonId } : {},
+          ...beforeLossNotes ? { lossNotes: beforeLossNotes } : {}
         },
         after: {
           ...afterStatus ? { status: titleStatus(afterStatus) } : {},
-          ...afterPipelineStageLabel ? { pipelineStageId: afterPipelineStageLabel } : {}
+          ...afterPipelineStageLabel ? { pipelineStageId: afterPipelineStageLabel } : {},
+          ...afterClosureOutcome ? { closureOutcome: titleStatus(afterClosureOutcome) } : closureOutcomeCleared ? { closureOutcome: "\u2014" } : {},
+          ...afterLossReasonId ? { lossReasonId: afterLossReasonId } : {},
+          ...afterLossNotes ? { lossNotes: afterLossNotes } : {}
         }
       }
     };

package/dist/modules/customers/ai-tools/deals-pack.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/ai-tools/deals-pack.ts"],
-  "sourcesContent": ["/**\n * `customers.list_deals` + `customers.get_deal` (Phase 1 WS-C, Step 3.9).\n * `customers.update_deal_stage` mutation tool (Phase 3 WS-C, Step 5.13).\n *\n * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:\n * `customers.list_deals` is now an API-backed wrapper over\n * `GET /api/customers/deals`. Tool name, schema, requiredFeatures, and output\n * shape are unchanged.\n *\n * Phase 3c of the same spec migrates `customers.get_deal` to the documented\n * aggregate detail route. The handler issues 1 call without `includeRelated`\n * (`GET /customers/deals/<id>`) and 3 bounded calls with `includeRelated`\n * (deal detail + activities + comments by `dealId`). The 3-call cap matches\n * the spec's residual N+1 budget; deeper aggregation can earn a first-class\n * API later without touching the AI surface.\n */\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { defineApiBackedAiTool } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/api-backed-tool'\nimport {\n  createAiApiOperationRunner,\n  type AiApiOperationRequest,\n  type AiToolExecutionContext,\n} from '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-api-operation-runner'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerDeal,\n  CustomerPipelineStage,\n} from '../data/entities'\nimport {\n  assertTenantScope,\n  type CustomersAiToolDefinition,\n  type CustomersToolContext,\n  type CustomersToolLoadBeforeSingleRecord,\n} from './types'\n\nfunction resolveEm(ctx: CustomersToolContext | AiToolExecutionContext): EntityManager {\n  return ctx.container.resolve<EntityManager>('em')\n}\n\nfunction buildScope(ctx: CustomersToolContext | AiToolExecutionContext, tenantId: string) {\n  return { tenantId, organizationId: ctx.organizationId }\n}\n\nconst listDealsInput = z\n  .object({\n    q: z.string().trim().optional().describe('Search text matched against deal title / description. Omit or leave empty to list all.'),\n    limit: z.number().int().min(1).max(100).optional().describe('Maximum rows to return (default 50, max 100).'),\n    offset: z.number().int().min(0).optional().describe('Number of rows to skip (default 0).'),\n    personId: z.string().uuid().optional().describe('Return only deals linked to this person entity id.'),\n    companyId: z.string().uuid().optional().describe('Return only deals linked to this company entity id.'),\n    pipelineStageId: z.string().uuid().optional().describe('Return only deals at this pipeline stage.'),\n    status: z.string().optional().describe('Filter by deal status (e.g. \"open\", \"won\", \"lost\").'),\n  })\n  .passthrough()\n\ntype ListDealsInput = z.infer<typeof listDealsInput>\n\ntype ListDealsApiItem = {\n  id?: string\n  title?: string | null\n  description?: string | null\n  status?: string | null\n  pipeline_id?: string | null\n  pipelineId?: string | null\n  pipeline_stage_id?: string | null\n  pipelineStageId?: string | null\n  value_amount?: string | number | null\n  valueAmount?: string | number | null\n  value_currency?: string | null\n  valueCurrency?: string | null\n  probability?: number | null\n  owner_user_id?: string | null\n  ownerUserId?: string | null\n  expected_close_at?: string | null\n  expectedCloseAt?: string | null\n  source?: string | null\n  organization_id?: string | null\n  organizationId?: string | null\n  tenant_id?: string | null\n  tenantId?: string | null\n  created_at?: string | null\n  createdAt?: string | null\n}\n\ntype ListDealsApiResponse = {\n  items?: ListDealsApiItem[]\n  total?: number\n}\n\ntype ListDealsOutput = {\n  items: Array<Record<string, unknown>>\n  total: number\n  limit: number\n  offset: number\n}\n\nconst listDealsTool = defineApiBackedAiTool<ListDealsInput, ListDealsApiResponse, ListDealsOutput>({\n  name: 'customers.list_deals',\n  displayName: 'List deals',\n  description:\n    'Search / list deals for the caller tenant + organization. Optional filters include linked person / company / pipeline stage. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor (\"at least N\", render it as \"N+\"), and pagination is exhausted only when a page returns fewer than limit items \u2014 never when offset reaches total.',\n  inputSchema: listDealsInput,\n  requiredFeatures: ['customers.deals.view'],\n  toOperation: (input, ctx) => {\n    assertTenantScope(ctx as unknown as CustomersToolContext)\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const page = Math.floor(offset / limit) + 1\n\n    const query: Record<string, string | number | boolean | null | undefined> = {\n      page,\n      pageSize: limit,\n    }\n    if (input.q?.trim()) query.search = input.q.trim()\n    if (input.personId) query.personId = input.personId\n    if (input.companyId) query.companyId = input.companyId\n    if (input.pipelineStageId) query.pipelineStageId = input.pipelineStageId\n    if (input.status) query.status = input.status\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: '/customers/deals',\n      query,\n    }\n    return operation\n  },\n  mapResponse: (response, input) => {\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const data = (response.data ?? {}) as ListDealsApiResponse\n    const rawItems: ListDealsApiItem[] = Array.isArray(data.items) ? data.items : []\n    return {\n      items: rawItems.map((row) => {\n        const expectedCloseRaw = row.expected_close_at ?? row.expectedCloseAt ?? null\n        const expectedCloseAt = expectedCloseRaw ? new Date(String(expectedCloseRaw)).toISOString() : null\n        const createdAtRaw = row.created_at ?? row.createdAt ?? null\n        const createdAt = createdAtRaw ? new Date(String(createdAtRaw)).toISOString() : null\n        return {\n          id: row.id,\n          title: row.title ?? null,\n          description: row.description ?? null,\n          status: row.status ?? null,\n          pipelineId: row.pipeline_id ?? row.pipelineId ?? null,\n          pipelineStageId: row.pipeline_stage_id ?? row.pipelineStageId ?? null,\n          valueAmount: row.value_amount ?? row.valueAmount ?? null,\n          valueCurrency: row.value_currency ?? row.valueCurrency ?? null,\n          probability: row.probability ?? null,\n          ownerUserId: row.owner_user_id ?? row.ownerUserId ?? null,\n          expectedCloseAt,\n          source: row.source ?? null,\n          organizationId: row.organization_id ?? row.organizationId ?? null,\n          tenantId: row.tenant_id ?? row.tenantId ?? null,\n          createdAt,\n        }\n      }),\n      total: typeof data.total === 'number' ? data.total : 0,\n      // A capped count reports a floor: phrase the total as \"at least N\" and\n      // never treat it as proof that pagination is exhausted.\n      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,\n      limit,\n      offset,\n    }\n  },\n}) as unknown as CustomersAiToolDefinition\n\nconst getDealInput = z.object({\n  dealId: z.string().uuid().describe('Deal id (UUID).'),\n  includeRelated: z\n    .boolean()\n    .optional()\n    .describe('When true, include notes, activities, linked people and companies (each capped at 100).'),\n})\n\ntype GetDealInput = z.infer<typeof getDealInput>\n\nfunction toIsoDeal(value: unknown): string | null {\n  if (!value) return null\n  const dt = value instanceof Date ? value : new Date(String(value))\n  if (Number.isNaN(dt.getTime())) return null\n  return dt.toISOString()\n}\n\nconst getDealTool: CustomersAiToolDefinition = {\n  name: 'customers.get_deal',\n  displayName: 'Get deal',\n  description:\n    'Fetch a deal by id with fields and (optionally) notes, activities, linked people, and linked companies. Returns { found: false } when outside tenant/org scope.',\n  inputSchema: getDealInput,\n  requiredFeatures: ['customers.deals.view'],\n  tags: ['read', 'customers'],\n  handler: async (rawInput, ctx) => {\n    const { tenantId: _tenantId } = assertTenantScope(ctx)\n    void _tenantId\n    const input: GetDealInput = getDealInput.parse(rawInput)\n    const includeRelated = !!input.includeRelated\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n\n    const detailResponse = await runner.run<Record<string, unknown>>({\n      method: 'GET',\n      path: `/customers/deals/${input.dealId}`,\n    })\n    if (!detailResponse.success) {\n      if (detailResponse.statusCode === 404 || detailResponse.statusCode === 403) {\n        return { found: false as const, dealId: input.dealId }\n      }\n      throw new Error(detailResponse.error ?? `Failed to fetch deal ${input.dealId}`)\n    }\n    const detail = (detailResponse.data ?? {}) as Record<string, unknown>\n    const dealRow = (detail.deal ?? null) as Record<string, unknown> | null\n    if (!dealRow) {\n      return { found: false as const, dealId: input.dealId }\n    }\n    const customFields = (detail.customFields ?? {}) as Record<string, unknown>\n    const peopleRows = Array.isArray(detail.people) ? (detail.people as Array<Record<string, unknown>>) : []\n    const companiesRows = Array.isArray(detail.companies)\n      ? (detail.companies as Array<Record<string, unknown>>)\n      : []\n\n    let related: Record<string, unknown> | null = null\n    if (includeRelated) {\n      const [activitiesResponse, commentsResponse] = await Promise.all([\n        runner.run<{ items?: Array<Record<string, unknown>>; total?: number }>({\n          method: 'GET',\n          path: '/customers/activities',\n          query: { dealId: input.dealId, page: 1, pageSize: 100, sortField: 'occurredAt', sortDir: 'desc' },\n        }),\n        runner.run<{ items?: Array<Record<string, unknown>>; total?: number }>({\n          method: 'GET',\n          path: '/customers/comments',\n          query: { dealId: input.dealId, page: 1, pageSize: 100 },\n        }),\n      ])\n      const activities =\n        activitiesResponse.success && Array.isArray(activitiesResponse.data?.items)\n          ? (activitiesResponse.data!.items as Array<Record<string, unknown>>)\n          : []\n      const comments =\n        commentsResponse.success && Array.isArray(commentsResponse.data?.items)\n          ? (commentsResponse.data!.items as Array<Record<string, unknown>>)\n          : []\n\n      related = {\n        activities: activities.map((activity) => ({\n          id: activity.id,\n          activityType: activity.activityType ?? activity.activity_type ?? null,\n          subject: activity.subject ?? null,\n          body: activity.body ?? null,\n          occurredAt: toIsoDeal(activity.occurredAt ?? activity.occurred_at),\n          createdAt: toIsoDeal(activity.createdAt ?? activity.created_at),\n        })),\n        notes: comments.map((comment) => ({\n          id: comment.id,\n          body: comment.body,\n          authorUserId: comment.authorUserId ?? comment.author_user_id ?? null,\n          createdAt: toIsoDeal(comment.createdAt ?? comment.created_at),\n        })),\n        people: peopleRows\n          .map((person) => {\n            if (!person || typeof person !== 'object') return null\n            const id = typeof person.id === 'string' ? person.id : null\n            if (!id) return null\n            const subtitle = typeof person.subtitle === 'string' ? person.subtitle : null\n            const label = typeof person.label === 'string' ? person.label : ''\n            const entry: {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n              participantRole: string | null\n            } = {\n              id,\n              displayName: label,\n              primaryEmail: subtitle && subtitle.includes('@') ? subtitle : null,\n              primaryPhone: subtitle && !subtitle.includes('@') ? subtitle : null,\n              participantRole: null as string | null,\n            }\n            return entry\n          })\n          .filter(\n            (value): value is {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n              participantRole: string | null\n            } => value !== null,\n          ),\n        companies: companiesRows\n          .map((company) => {\n            if (!company || typeof company !== 'object') return null\n            const id = typeof company.id === 'string' ? company.id : null\n            if (!id) return null\n            const label = typeof company.label === 'string' ? company.label : ''\n            const entry: {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n            } = {\n              id,\n              displayName: label,\n              primaryEmail: null as string | null,\n              primaryPhone: null as string | null,\n            }\n            return entry\n          })\n          .filter(\n            (value): value is {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n            } => value !== null,\n          ),\n      }\n    }\n\n    return {\n      found: true as const,\n      deal: {\n        id: dealRow.id,\n        title: typeof dealRow.title === 'string' ? dealRow.title : '',\n        description: dealRow.description ?? null,\n        status: dealRow.status ?? null,\n        pipelineId: dealRow.pipelineId ?? null,\n        pipelineStageId: dealRow.pipelineStageId ?? null,\n        valueAmount: dealRow.valueAmount ?? null,\n        valueCurrency: dealRow.valueCurrency ?? null,\n        probability: dealRow.probability ?? null,\n        ownerUserId: dealRow.ownerUserId ?? null,\n        expectedCloseAt: toIsoDeal(dealRow.expectedCloseAt),\n        source: dealRow.source ?? null,\n        organizationId: dealRow.organizationId ?? null,\n        tenantId: dealRow.tenantId ?? null,\n        createdAt: toIsoDeal(dealRow.createdAt),\n        updatedAt: toIsoDeal(dealRow.updatedAt),\n      },\n      customFields,\n      related,\n    }\n  },\n}\n\n/**\n * Mutation tool: move a deal to a different pipeline stage. Step 5.13 \u2014 first\n * mutation-capable flow on the pending-action contract.\n *\n * Accepts either `toPipelineStageId` (UUID \u2014 preferred, tenant-scoped stage\n * record) or `toStage` (free-form string that maps to `CustomerDeal.status`\n * for pipeline roots like `open`/`won`/`lost`). Exactly one must be provided.\n *\n * The handler delegates to the existing `customers.deals.update` command so\n * all side effects (audit log, `customers.deal.updated` event, query index\n * refresh, notifications) stay identical to a direct API write.\n */\n// LLMs frequently emit `\"\"` for \"not provided\" \u2014 coerce blanks (and surrounding\n// whitespace) to `undefined` BEFORE the per-field validators run so the\n// `.uuid()` check on `toPipelineStageId` does not blow up on an empty string\n// the caller actually meant as \"skip this field\".\nconst blankToUndefined = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length === 0 ? undefined : trimmed\n}\n\nconst updateDealStageInput = z\n  .object({\n    dealId: z.string().uuid().describe('Deal id (UUID) to update.'),\n    toPipelineStageId: z\n      .preprocess(blankToUndefined, z.string().uuid().optional())\n      .describe('Target pipeline stage id (UUID). Preferred \u2014 tenant-scoped stage record.'),\n    toStage: z\n      .preprocess(blankToUndefined, z.string().min(1).max(50).optional())\n      .describe(\n        'Target status slug (e.g. \"open\", \"won\", \"lost\"). Used when the deal does not belong to a managed pipeline.',\n      ),\n  })\n  .refine(\n    (value) => Boolean(value.toPipelineStageId) !== Boolean(value.toStage),\n    {\n      message: 'Provide exactly one of toPipelineStageId or toStage.',\n      path: ['toPipelineStageId'],\n    },\n  )\n\ntype UpdateDealStageInput = z.infer<typeof updateDealStageInput>\n\nfunction recordVersionFromUpdatedAt(updatedAt: Date | null | undefined): string | null {\n  if (!updatedAt) return null\n  const value = updatedAt instanceof Date ? updatedAt : new Date(updatedAt)\n  if (Number.isNaN(value.getTime())) return null\n  return value.toISOString()\n}\n\nfunction titleStatus(value: string | null | undefined): string | undefined {\n  if (!value) return undefined\n  return value\n    .split(/[_\\s-]+/)\n    .filter(Boolean)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n    .join(' ')\n}\n\nasync function loadDealWithStage(\n  em: EntityManager,\n  ctx: CustomersToolContext,\n  tenantId: string,\n  dealId: string,\n): Promise<CustomerDeal | null> {\n  const where: Record<string, unknown> = { id: dealId, tenantId, deletedAt: null }\n  if (ctx.organizationId) where.organizationId = ctx.organizationId\n  const deal = await findOneWithDecryption<CustomerDeal>(\n    em,\n    CustomerDeal,\n    where as FilterQuery<CustomerDeal>,\n    undefined,\n    buildScope(ctx, tenantId),\n  )\n  if (!deal || deal.tenantId !== tenantId) return null\n  if (ctx.organizationId && deal.organizationId !== ctx.organizationId) return null\n  return deal\n}\n\nasync function loadPipelineStage(\n  em: EntityManager,\n  ctx: CustomersToolContext,\n  tenantId: string,\n  stageId: string,\n  organizationId: string,\n): Promise<CustomerPipelineStage | null> {\n  return findOneWithDecryption<CustomerPipelineStage>(\n    em,\n    CustomerPipelineStage,\n    {\n      id: stageId,\n      tenantId,\n      organizationId,\n    },\n    undefined,\n    buildScope(ctx, tenantId),\n  )\n}\n\nconst updateDealStageTool: CustomersAiToolDefinition = {\n  name: 'customers.update_deal_stage',\n  displayName: 'Update deal stage',\n  description:\n    'Move a deal to a different pipeline stage (by stage id) or change its top-level status (e.g. \"open\", \"won\", \"lost\"). Mutation tool \u2014 flows through the AI pending-action approval gate.',\n  inputSchema: updateDealStageInput as z.ZodType<unknown>,\n  requiredFeatures: ['customers.deals.manage'],\n  tags: ['write', 'customers'],\n  isMutation: true,\n  loadBeforeRecord: async (rawInput, ctx): Promise<CustomersToolLoadBeforeSingleRecord | null> => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input: UpdateDealStageInput = updateDealStageInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const deal = await loadDealWithStage(em, ctx, tenantId, input.dealId)\n    if (!deal) return null\n    let afterStatus = deal.status ?? null\n    let afterPipelineStageId = deal.pipelineStageId ?? null\n    let afterPipelineStageLabel = deal.pipelineStage ?? null\n    if (input.toPipelineStageId) {\n      const organizationId = deal.organizationId ?? ctx.organizationId ?? null\n      const stage = organizationId\n        ? await loadPipelineStage(em, ctx, tenantId, input.toPipelineStageId, organizationId)\n        : null\n      afterPipelineStageId = input.toPipelineStageId\n      afterPipelineStageLabel = stage?.label ?? input.toPipelineStageId\n    } else if (input.toStage) {\n      afterStatus = input.toStage\n    }\n    const beforeStatus = deal.status ?? null\n    const beforePipelineStageId = deal.pipelineStageId ?? null\n    const beforePipelineStageLabel = deal.pipelineStage ?? beforePipelineStageId\n    return {\n      recordId: deal.id,\n      entityType: 'customers.deal',\n      recordVersion: recordVersionFromUpdatedAt(deal.updatedAt),\n      before: {\n        status: beforeStatus,\n        pipelineStageId: beforePipelineStageId,\n      },\n      after: {\n        status: afterStatus,\n        pipelineStageId: afterPipelineStageId,\n      },\n      display: {\n        fieldLabels: {\n          status: 'Status',\n          pipelineStageId: 'Pipeline stage',\n        },\n        before: {\n          ...(beforeStatus ? { status: titleStatus(beforeStatus) } : {}),\n          ...(beforePipelineStageLabel ? { pipelineStageId: beforePipelineStageLabel } : {}),\n        },\n        after: {\n          ...(afterStatus ? { status: titleStatus(afterStatus) } : {}),\n          ...(afterPipelineStageLabel ? { pipelineStageId: afterPipelineStageLabel } : {}),\n        },\n      },\n    }\n  },\n  handler: async (rawInput, ctx) => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input: UpdateDealStageInput = updateDealStageInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const deal = await loadDealWithStage(em, ctx, tenantId, input.dealId)\n    if (!deal) {\n      throw new Error(`Deal \"${input.dealId}\" is not accessible to the caller.`)\n    }\n    const organizationId = deal.organizationId\n    if (!organizationId) {\n      throw new Error(`Deal \"${input.dealId}\" has no organization scope.`)\n    }\n\n    const before = {\n      status: deal.status ?? null,\n      pipelineStage: deal.pipelineStage ?? null,\n      pipelineStageId: deal.pipelineStageId ?? null,\n    }\n\n    const body: Record<string, unknown> = {\n      id: deal.id,\n      tenantId,\n      organizationId,\n    }\n    if (input.toPipelineStageId) {\n      const stage = await loadPipelineStage(em, ctx, tenantId, input.toPipelineStageId, organizationId)\n      if (!stage) {\n        throw new Error('Pipeline stage not found.')\n      }\n      body.pipelineStageId = input.toPipelineStageId\n    } else if (input.toStage) {\n      body.status = input.toStage\n    }\n\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n    const response = await runner.run({\n      method: 'PUT',\n      path: '/customers/deals',\n      body,\n    })\n    if (!response.success) {\n      throw new Error(response.error ?? `Failed to update deal \"${deal.id}\"`)\n    }\n\n    const after = await loadDealWithStage(em, ctx, tenantId, deal.id)\n    return {\n      recordId: deal.id,\n      commandName: 'customers.deals.update',\n      before,\n      after: after\n        ? {\n            status: after.status ?? null,\n            pipelineStage: after.pipelineStage ?? null,\n            pipelineStageId: after.pipelineStageId ?? null,\n          }\n        : null,\n    }\n  },\n}\n\nexport const dealsAiTools: CustomersAiToolDefinition[] = [listDealsTool, getDealTool, updateDealStageTool]\n\nexport default dealsAiTools\n"],
-  "mappings": "AAiBA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAIK;AAEP,SAAS,UAAU,KAAmE;AACpF,SAAO,IAAI,UAAU,QAAuB,IAAI;AAClD;AAEA,SAAS,WAAW,KAAoD,UAAkB;AACxF,SAAO,EAAE,UAAU,gBAAgB,IAAI,eAAe;AACxD;AAEA,MAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,wFAAwF;AAAA,EACjI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EAC3G,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACzF,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EACpG,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,qDAAqD;AAAA,EACtG,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,2CAA2C;AAAA,EAClG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qDAAqD;AAC9F,CAAC,EACA,YAAY;AA2Cf,MAAM,gBAAgB,sBAA6E;AAAA,EACjG,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,aAAa,CAAC,OAAO,QAAQ;AAC3B,sBAAkB,GAAsC;AACxD,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAO,KAAK,MAAM,SAAS,KAAK,IAAI;AAE1C,UAAM,QAAsE;AAAA,MAC1E;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,GAAG,KAAK,EAAG,OAAM,SAAS,MAAM,EAAE,KAAK;AACjD,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,UAAW,OAAM,YAAY,MAAM;AAC7C,QAAI,MAAM,gBAAiB,OAAM,kBAAkB,MAAM;AACzD,QAAI,MAAM,OAAQ,OAAM,SAAS,MAAM;AAEvC,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,aAAa,CAAC,UAAU,UAAU;AAChC,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,WAA+B,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAC/E,WAAO;AAAA,MACL,OAAO,SAAS,IAAI,CAAC,QAAQ;AAC3B,cAAM,mBAAmB,IAAI,qBAAqB,IAAI,mBAAmB;AACzE,cAAM,kBAAkB,mBAAmB,IAAI,KAAK,OAAO,gBAAgB,CAAC,EAAE,YAAY,IAAI;AAC9F,cAAM,eAAe,IAAI,cAAc,IAAI,aAAa;AACxD,cAAM,YAAY,eAAe,IAAI,KAAK,OAAO,YAAY,CAAC,EAAE,YAAY,IAAI;AAChF,eAAO;AAAA,UACL,IAAI,IAAI;AAAA,UACR,OAAO,IAAI,SAAS;AAAA,UACpB,aAAa,IAAI,eAAe;AAAA,UAChC,QAAQ,IAAI,UAAU;AAAA,UACtB,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,UACjD,iBAAiB,IAAI,qBAAqB,IAAI,mBAAmB;AAAA,UACjE,aAAa,IAAI,gBAAgB,IAAI,eAAe;AAAA,UACpD,eAAe,IAAI,kBAAkB,IAAI,iBAAiB;AAAA,UAC1D,aAAa,IAAI,eAAe;AAAA,UAChC,aAAa,IAAI,iBAAiB,IAAI,eAAe;AAAA,UACrD;AAAA,UACA,QAAQ,IAAI,UAAU;AAAA,UACtB,gBAAgB,IAAI,mBAAmB,IAAI,kBAAkB;AAAA,UAC7D,UAAU,IAAI,aAAa,IAAI,YAAY;AAAA,UAC3C;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MACD,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAAA;AAAA;AAAA,MAGrD,eAAgB,KAAqC,kBAAkB;AAAA,MACvE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB;AAAA,EACpD,gBAAgB,EACb,QAAQ,EACR,SAAS,EACT,SAAS,yFAAyF;AACvG,CAAC;AAID,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KAAK,iBAAiB,OAAO,QAAQ,IAAI,KAAK,OAAO,KAAK,CAAC;AACjE,MAAI,OAAO,MAAM,GAAG,QAAQ,CAAC,EAAG,QAAO;AACvC,SAAO,GAAG,YAAY;AACxB;AAEA,MAAM,cAAyC;AAAA,EAC7C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC1B,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,UAAU,UAAU,IAAI,kBAAkB,GAAG;AACrD,SAAK;AACL,UAAM,QAAsB,aAAa,MAAM,QAAQ;AACvD,UAAM,iBAAiB,CAAC,CAAC,MAAM;AAC/B,UAAM,SAAS,2BAA2B,GAAwC;AAElF,UAAM,iBAAiB,MAAM,OAAO,IAA6B;AAAA,MAC/D,QAAQ;AAAA,MACR,MAAM,oBAAoB,MAAM,MAAM;AAAA,IACxC,CAAC;AACD,QAAI,CAAC,eAAe,SAAS;AAC3B,UAAI,eAAe,eAAe,OAAO,eAAe,eAAe,KAAK;AAC1E,eAAO,EAAE,OAAO,OAAgB,QAAQ,MAAM,OAAO;AAAA,MACvD;AACA,YAAM,IAAI,MAAM,eAAe,SAAS,wBAAwB,MAAM,MAAM,EAAE;AAAA,IAChF;AACA,UAAM,SAAU,eAAe,QAAQ,CAAC;AACxC,UAAM,UAAW,OAAO,QAAQ;AAChC,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,OAAO,OAAgB,QAAQ,MAAM,OAAO;AAAA,IACvD;AACA,UAAM,eAAgB,OAAO,gBAAgB,CAAC;AAC9C,UAAM,aAAa,MAAM,QAAQ,OAAO,MAAM,IAAK,OAAO,SAA4C,CAAC;AACvG,UAAM,gBAAgB,MAAM,QAAQ,OAAO,SAAS,IAC/C,OAAO,YACR,CAAC;AAEL,QAAI,UAA0C;AAC9C,QAAI,gBAAgB;AAClB,YAAM,CAAC,oBAAoB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/D,OAAO,IAAgE;AAAA,UACrE,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,GAAG,UAAU,KAAK,WAAW,cAAc,SAAS,OAAO;AAAA,QAClG,CAAC;AAAA,QACD,OAAO,IAAgE;AAAA,UACrE,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,GAAG,UAAU,IAAI;AAAA,QACxD,CAAC;AAAA,MACH,CAAC;AACD,YAAM,aACJ,mBAAmB,WAAW,MAAM,QAAQ,mBAAmB,MAAM,KAAK,IACrE,mBAAmB,KAAM,QAC1B,CAAC;AACP,YAAM,WACJ,iBAAiB,WAAW,MAAM,QAAQ,iBAAiB,MAAM,KAAK,IACjE,iBAAiB,KAAM,QACxB,CAAC;AAEP,gBAAU;AAAA,QACR,YAAY,WAAW,IAAI,CAAC,cAAc;AAAA,UACxC,IAAI,SAAS;AAAA,UACb,cAAc,SAAS,gBAAgB,SAAS,iBAAiB;AAAA,UACjE,SAAS,SAAS,WAAW;AAAA,UAC7B,MAAM,SAAS,QAAQ;AAAA,UACvB,YAAY,UAAU,SAAS,cAAc,SAAS,WAAW;AAAA,UACjE,WAAW,UAAU,SAAS,aAAa,SAAS,UAAU;AAAA,QAChE,EAAE;AAAA,QACF,OAAO,SAAS,IAAI,CAAC,aAAa;AAAA,UAChC,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB,QAAQ,kBAAkB;AAAA,UAChE,WAAW,UAAU,QAAQ,aAAa,QAAQ,UAAU;AAAA,QAC9D,EAAE;AAAA,QACF,QAAQ,WACL,IAAI,CAAC,WAAW;AACf,cAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,gBAAM,KAAK,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACvD,cAAI,CAAC,GAAI,QAAO;AAChB,gBAAM,WAAW,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACzE,gBAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,gBAAM,QAMF;AAAA,YACF;AAAA,YACA,aAAa;AAAA,YACb,cAAc,YAAY,SAAS,SAAS,GAAG,IAAI,WAAW;AAAA,YAC9D,cAAc,YAAY,CAAC,SAAS,SAAS,GAAG,IAAI,WAAW;AAAA,YAC/D,iBAAiB;AAAA,UACnB;AACA,iBAAO;AAAA,QACT,CAAC,EACA;AAAA,UACC,CAAC,UAMI,UAAU;AAAA,QACjB;AAAA,QACF,WAAW,cACR,IAAI,CAAC,YAAY;AAChB,cAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,gBAAM,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AACzD,cAAI,CAAC,GAAI,QAAO;AAChB,gBAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAClE,gBAAM,QAKF;AAAA,YACF;AAAA,YACA,aAAa;AAAA,YACb,cAAc;AAAA,YACd,cAAc;AAAA,UAChB;AACA,iBAAO;AAAA,QACT,CAAC,EACA;AAAA,UACC,CAAC,UAKI,UAAU;AAAA,QACjB;AAAA,MACJ;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,QACJ,IAAI,QAAQ;AAAA,QACZ,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,QAC3D,aAAa,QAAQ,eAAe;AAAA,QACpC,QAAQ,QAAQ,UAAU;AAAA,QAC1B,YAAY,QAAQ,cAAc;AAAA,QAClC,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,aAAa,QAAQ,eAAe;AAAA,QACpC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,aAAa,QAAQ,eAAe;AAAA,QACpC,aAAa,QAAQ,eAAe;AAAA,QACpC,iBAAiB,UAAU,QAAQ,eAAe;AAAA,QAClD,QAAQ,QAAQ,UAAU;AAAA,QAC1B,gBAAgB,QAAQ,kBAAkB;AAAA,QAC1C,UAAU,QAAQ,YAAY;AAAA,QAC9B,WAAW,UAAU,QAAQ,SAAS;AAAA,QACtC,WAAW,UAAU,QAAQ,SAAS;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAkBA,MAAM,mBAAmB,CAAC,UAA4B;AACpD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,IAAI,SAAY;AAC5C;AAEA,MAAM,uBAAuB,EAC1B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,2BAA2B;AAAA,EAC9D,mBAAmB,EAChB,WAAW,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EACzD,SAAS,+EAA0E;AAAA,EACtF,SAAS,EACN,WAAW,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,EACjE;AAAA,IACC;AAAA,EACF;AACJ,CAAC,EACA;AAAA,EACC,CAAC,UAAU,QAAQ,MAAM,iBAAiB,MAAM,QAAQ,MAAM,OAAO;AAAA,EACrE;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,mBAAmB;AAAA,EAC5B;AACF;AAIF,SAAS,2BAA2B,WAAmD;AACrF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,QAAQ,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS;AACxE,MAAI,OAAO,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC1C,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,YAAY,OAAsD;AACzE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MACJ,MAAM,SAAS,EACf,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,EAC1D,KAAK,GAAG;AACb;AAEA,eAAe,kBACb,IACA,KACA,UACA,QAC8B;AAC9B,QAAM,QAAiC,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC/E,MAAI,IAAI,eAAgB,OAAM,iBAAiB,IAAI;AACnD,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,KAAK,QAAQ;AAAA,EAC1B;AACA,MAAI,CAAC,QAAQ,KAAK,aAAa,SAAU,QAAO;AAChD,MAAI,IAAI,kBAAkB,KAAK,mBAAmB,IAAI,eAAgB,QAAO;AAC7E,SAAO;AACT;AAEA,eAAe,kBACb,IACA,KACA,UACA,SACA,gBACuC;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,IACA,WAAW,KAAK,QAAQ;AAAA,EAC1B;AACF;AAEA,MAAM,sBAAiD;AAAA,EACrD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,wBAAwB;AAAA,EAC3C,MAAM,CAAC,SAAS,WAAW;AAAA,EAC3B,YAAY;AAAA,EACZ,kBAAkB,OAAO,UAAU,QAA6D;AAC9F,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAA8B,qBAAqB,MAAM,QAAQ;AACvE,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,OAAO,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,MAAM;AACpE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,cAAc,KAAK,UAAU;AACjC,QAAI,uBAAuB,KAAK,mBAAmB;AACnD,QAAI,0BAA0B,KAAK,iBAAiB;AACpD,QAAI,MAAM,mBAAmB;AAC3B,YAAM,iBAAiB,KAAK,kBAAkB,IAAI,kBAAkB;AACpE,YAAM,QAAQ,iBACV,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,mBAAmB,cAAc,IAClF;AACJ,6BAAuB,MAAM;AAC7B,gCAA0B,OAAO,SAAS,MAAM;AAAA,IAClD,WAAW,MAAM,SAAS;AACxB,oBAAc,MAAM;AAAA,IACtB;AACA,UAAM,eAAe,KAAK,UAAU;AACpC,UAAM,wBAAwB,KAAK,mBAAmB;AACtD,UAAM,2BAA2B,KAAK,iBAAiB;AACvD,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,YAAY;AAAA,MACZ,eAAe,2BAA2B,KAAK,SAAS;AAAA,MACxD,QAAQ;AAAA,QACN,QAAQ;AAAA,QACR,iBAAiB;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,iBAAiB;AAAA,MACnB;AAAA,MACA,SAAS;AAAA,QACP,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,iBAAiB;AAAA,QACnB;AAAA,QACA,QAAQ;AAAA,UACN,GAAI,eAAe,EAAE,QAAQ,YAAY,YAAY,EAAE,IAAI,CAAC;AAAA,UAC5D,GAAI,2BAA2B,EAAE,iBAAiB,yBAAyB,IAAI,CAAC;AAAA,QAClF;AAAA,QACA,OAAO;AAAA,UACL,GAAI,cAAc,EAAE,QAAQ,YAAY,WAAW,EAAE,IAAI,CAAC;AAAA,UAC1D,GAAI,0BAA0B,EAAE,iBAAiB,wBAAwB,IAAI,CAAC;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAA8B,qBAAqB,MAAM,QAAQ;AACvE,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,OAAO,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,MAAM;AACpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,SAAS,MAAM,MAAM,oCAAoC;AAAA,IAC3E;AACA,UAAM,iBAAiB,KAAK;AAC5B,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,SAAS,MAAM,MAAM,8BAA8B;AAAA,IACrE;AAEA,UAAM,SAAS;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,IAC3C;AAEA,UAAM,OAAgC;AAAA,MACpC,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,QAAI,MAAM,mBAAmB;AAC3B,YAAM,QAAQ,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,mBAAmB,cAAc;AAChG,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,WAAK,kBAAkB,MAAM;AAAA,IAC/B,WAAW,MAAM,SAAS;AACxB,WAAK,SAAS,MAAM;AAAA,IACtB;AAEA,UAAM,SAAS,2BAA2B,GAAwC;AAClF,UAAM,WAAW,MAAM,OAAO,IAAI;AAAA,MAChC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,SAAS;AACrB,YAAM,IAAI,MAAM,SAAS,SAAS,0BAA0B,KAAK,EAAE,GAAG;AAAA,IACxE;AAEA,UAAM,QAAQ,MAAM,kBAAkB,IAAI,KAAK,UAAU,KAAK,EAAE;AAChE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,OAAO,QACH;AAAA,QACE,QAAQ,MAAM,UAAU;AAAA,QACxB,eAAe,MAAM,iBAAiB;AAAA,QACtC,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,IACA;AAAA,IACN;AAAA,EACF;AACF;AAEO,MAAM,eAA4C,CAAC,eAAe,aAAa,mBAAmB;AAEzG,IAAO,qBAAQ;",
+  "sourcesContent": ["/**\n * `customers.list_deals` + `customers.get_deal` (Phase 1 WS-C, Step 3.9).\n * `customers.update_deal_stage` mutation tool (Phase 3 WS-C, Step 5.13).\n *\n * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:\n * `customers.list_deals` is now an API-backed wrapper over\n * `GET /api/customers/deals`. Tool name, schema, requiredFeatures, and output\n * shape are unchanged.\n *\n * Phase 3c of the same spec migrates `customers.get_deal` to the documented\n * aggregate detail route. The handler issues 1 call without `includeRelated`\n * (`GET /customers/deals/<id>`) and 3 bounded calls with `includeRelated`\n * (deal detail + activities + comments by `dealId`). The 3-call cap matches\n * the spec's residual N+1 budget; deeper aggregation can earn a first-class\n * API later without touching the AI surface.\n */\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { defineApiBackedAiTool } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/api-backed-tool'\nimport {\n  createAiApiOperationRunner,\n  type AiApiOperationRequest,\n  type AiToolExecutionContext,\n} from '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-api-operation-runner'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerDeal,\n  CustomerPipelineStage,\n} from '../data/entities'\nimport {\n  dealClosureOutcomeFromStatus,\n  loadClosurePipelineStageSnapshot,\n} from '../lib/closureStage'\nimport { canonicalDealStatus, isClosedDealStatus } from '../lib/dealStatus'\nimport {\n  assertTenantScope,\n  type CustomersAiToolDefinition,\n  type CustomersToolContext,\n  type CustomersToolLoadBeforeSingleRecord,\n} from './types'\n\nfunction resolveEm(ctx: CustomersToolContext | AiToolExecutionContext): EntityManager {\n  return ctx.container.resolve<EntityManager>('em')\n}\n\nfunction buildScope(ctx: CustomersToolContext | AiToolExecutionContext, tenantId: string) {\n  return { tenantId, organizationId: ctx.organizationId }\n}\n\nconst listDealsInput = z\n  .object({\n    q: z.string().trim().optional().describe('Search text matched against deal title / description. Omit or leave empty to list all.'),\n    limit: z.number().int().min(1).max(100).optional().describe('Maximum rows to return (default 50, max 100).'),\n    offset: z.number().int().min(0).optional().describe('Number of rows to skip (default 0).'),\n    personId: z.string().uuid().optional().describe('Return only deals linked to this person entity id.'),\n    companyId: z.string().uuid().optional().describe('Return only deals linked to this company entity id.'),\n    pipelineStageId: z.string().uuid().optional().describe('Return only deals at this pipeline stage.'),\n    status: z.string().optional().describe('Filter by deal status (e.g. \"open\", \"won\", \"lost\").'),\n  })\n  .passthrough()\n\ntype ListDealsInput = z.infer<typeof listDealsInput>\n\ntype ListDealsApiItem = {\n  id?: string\n  title?: string | null\n  description?: string | null\n  status?: string | null\n  pipeline_id?: string | null\n  pipelineId?: string | null\n  pipeline_stage_id?: string | null\n  pipelineStageId?: string | null\n  value_amount?: string | number | null\n  valueAmount?: string | number | null\n  value_currency?: string | null\n  valueCurrency?: string | null\n  probability?: number | null\n  owner_user_id?: string | null\n  ownerUserId?: string | null\n  expected_close_at?: string | null\n  expectedCloseAt?: string | null\n  source?: string | null\n  organization_id?: string | null\n  organizationId?: string | null\n  tenant_id?: string | null\n  tenantId?: string | null\n  created_at?: string | null\n  createdAt?: string | null\n}\n\ntype ListDealsApiResponse = {\n  items?: ListDealsApiItem[]\n  total?: number\n}\n\ntype ListDealsOutput = {\n  items: Array<Record<string, unknown>>\n  total: number\n  limit: number\n  offset: number\n}\n\nconst listDealsTool = defineApiBackedAiTool<ListDealsInput, ListDealsApiResponse, ListDealsOutput>({\n  name: 'customers.list_deals',\n  displayName: 'List deals',\n  description:\n    'Search / list deals for the caller tenant + organization. Optional filters include linked person / company / pipeline stage. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor (\"at least N\", render it as \"N+\"), and pagination is exhausted only when a page returns fewer than limit items \u2014 never when offset reaches total.',\n  inputSchema: listDealsInput,\n  requiredFeatures: ['customers.deals.view'],\n  toOperation: (input, ctx) => {\n    assertTenantScope(ctx as unknown as CustomersToolContext)\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const page = Math.floor(offset / limit) + 1\n\n    const query: Record<string, string | number | boolean | null | undefined> = {\n      page,\n      pageSize: limit,\n    }\n    if (input.q?.trim()) query.search = input.q.trim()\n    if (input.personId) query.personId = input.personId\n    if (input.companyId) query.companyId = input.companyId\n    if (input.pipelineStageId) query.pipelineStageId = input.pipelineStageId\n    if (input.status) query.status = input.status\n\n    const operation: AiApiOperationRequest = {\n      method: 'GET',\n      path: '/customers/deals',\n      query,\n    }\n    return operation\n  },\n  mapResponse: (response, input) => {\n    const limit = input.limit ?? 50\n    const offset = input.offset ?? 0\n    const data = (response.data ?? {}) as ListDealsApiResponse\n    const rawItems: ListDealsApiItem[] = Array.isArray(data.items) ? data.items : []\n    return {\n      items: rawItems.map((row) => {\n        const expectedCloseRaw = row.expected_close_at ?? row.expectedCloseAt ?? null\n        const expectedCloseAt = expectedCloseRaw ? new Date(String(expectedCloseRaw)).toISOString() : null\n        const createdAtRaw = row.created_at ?? row.createdAt ?? null\n        const createdAt = createdAtRaw ? new Date(String(createdAtRaw)).toISOString() : null\n        return {\n          id: row.id,\n          title: row.title ?? null,\n          description: row.description ?? null,\n          status: row.status ?? null,\n          pipelineId: row.pipeline_id ?? row.pipelineId ?? null,\n          pipelineStageId: row.pipeline_stage_id ?? row.pipelineStageId ?? null,\n          valueAmount: row.value_amount ?? row.valueAmount ?? null,\n          valueCurrency: row.value_currency ?? row.valueCurrency ?? null,\n          probability: row.probability ?? null,\n          ownerUserId: row.owner_user_id ?? row.ownerUserId ?? null,\n          expectedCloseAt,\n          source: row.source ?? null,\n          organizationId: row.organization_id ?? row.organizationId ?? null,\n          tenantId: row.tenant_id ?? row.tenantId ?? null,\n          createdAt,\n        }\n      }),\n      total: typeof data.total === 'number' ? data.total : 0,\n      // A capped count reports a floor: phrase the total as \"at least N\" and\n      // never treat it as proof that pagination is exhausted.\n      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,\n      limit,\n      offset,\n    }\n  },\n}) as unknown as CustomersAiToolDefinition\n\nconst getDealInput = z.object({\n  dealId: z.string().uuid().describe('Deal id (UUID).'),\n  includeRelated: z\n    .boolean()\n    .optional()\n    .describe('When true, include notes, activities, linked people and companies (each capped at 100).'),\n})\n\ntype GetDealInput = z.infer<typeof getDealInput>\n\nfunction toIsoDeal(value: unknown): string | null {\n  if (!value) return null\n  const dt = value instanceof Date ? value : new Date(String(value))\n  if (Number.isNaN(dt.getTime())) return null\n  return dt.toISOString()\n}\n\nconst getDealTool: CustomersAiToolDefinition = {\n  name: 'customers.get_deal',\n  displayName: 'Get deal',\n  description:\n    'Fetch a deal by id with fields and (optionally) notes, activities, linked people, and linked companies. Returns { found: false } when outside tenant/org scope.',\n  inputSchema: getDealInput,\n  requiredFeatures: ['customers.deals.view'],\n  tags: ['read', 'customers'],\n  handler: async (rawInput, ctx) => {\n    const { tenantId: _tenantId } = assertTenantScope(ctx)\n    void _tenantId\n    const input: GetDealInput = getDealInput.parse(rawInput)\n    const includeRelated = !!input.includeRelated\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n\n    const detailResponse = await runner.run<Record<string, unknown>>({\n      method: 'GET',\n      path: `/customers/deals/${input.dealId}`,\n    })\n    if (!detailResponse.success) {\n      if (detailResponse.statusCode === 404 || detailResponse.statusCode === 403) {\n        return { found: false as const, dealId: input.dealId }\n      }\n      throw new Error(detailResponse.error ?? `Failed to fetch deal ${input.dealId}`)\n    }\n    const detail = (detailResponse.data ?? {}) as Record<string, unknown>\n    const dealRow = (detail.deal ?? null) as Record<string, unknown> | null\n    if (!dealRow) {\n      return { found: false as const, dealId: input.dealId }\n    }\n    const customFields = (detail.customFields ?? {}) as Record<string, unknown>\n    const peopleRows = Array.isArray(detail.people) ? (detail.people as Array<Record<string, unknown>>) : []\n    const companiesRows = Array.isArray(detail.companies)\n      ? (detail.companies as Array<Record<string, unknown>>)\n      : []\n\n    let related: Record<string, unknown> | null = null\n    if (includeRelated) {\n      const [activitiesResponse, commentsResponse] = await Promise.all([\n        runner.run<{ items?: Array<Record<string, unknown>>; total?: number }>({\n          method: 'GET',\n          path: '/customers/activities',\n          query: { dealId: input.dealId, page: 1, pageSize: 100, sortField: 'occurredAt', sortDir: 'desc' },\n        }),\n        runner.run<{ items?: Array<Record<string, unknown>>; total?: number }>({\n          method: 'GET',\n          path: '/customers/comments',\n          query: { dealId: input.dealId, page: 1, pageSize: 100 },\n        }),\n      ])\n      const activities =\n        activitiesResponse.success && Array.isArray(activitiesResponse.data?.items)\n          ? (activitiesResponse.data!.items as Array<Record<string, unknown>>)\n          : []\n      const comments =\n        commentsResponse.success && Array.isArray(commentsResponse.data?.items)\n          ? (commentsResponse.data!.items as Array<Record<string, unknown>>)\n          : []\n\n      related = {\n        activities: activities.map((activity) => ({\n          id: activity.id,\n          activityType: activity.activityType ?? activity.activity_type ?? null,\n          subject: activity.subject ?? null,\n          body: activity.body ?? null,\n          occurredAt: toIsoDeal(activity.occurredAt ?? activity.occurred_at),\n          createdAt: toIsoDeal(activity.createdAt ?? activity.created_at),\n        })),\n        notes: comments.map((comment) => ({\n          id: comment.id,\n          body: comment.body,\n          authorUserId: comment.authorUserId ?? comment.author_user_id ?? null,\n          createdAt: toIsoDeal(comment.createdAt ?? comment.created_at),\n        })),\n        people: peopleRows\n          .map((person) => {\n            if (!person || typeof person !== 'object') return null\n            const id = typeof person.id === 'string' ? person.id : null\n            if (!id) return null\n            const subtitle = typeof person.subtitle === 'string' ? person.subtitle : null\n            const label = typeof person.label === 'string' ? person.label : ''\n            const entry: {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n              participantRole: string | null\n            } = {\n              id,\n              displayName: label,\n              primaryEmail: subtitle && subtitle.includes('@') ? subtitle : null,\n              primaryPhone: subtitle && !subtitle.includes('@') ? subtitle : null,\n              participantRole: null as string | null,\n            }\n            return entry\n          })\n          .filter(\n            (value): value is {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n              participantRole: string | null\n            } => value !== null,\n          ),\n        companies: companiesRows\n          .map((company) => {\n            if (!company || typeof company !== 'object') return null\n            const id = typeof company.id === 'string' ? company.id : null\n            if (!id) return null\n            const label = typeof company.label === 'string' ? company.label : ''\n            const entry: {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n            } = {\n              id,\n              displayName: label,\n              primaryEmail: null as string | null,\n              primaryPhone: null as string | null,\n            }\n            return entry\n          })\n          .filter(\n            (value): value is {\n              id: string\n              displayName: string\n              primaryEmail: string | null\n              primaryPhone: string | null\n            } => value !== null,\n          ),\n      }\n    }\n\n    return {\n      found: true as const,\n      deal: {\n        id: dealRow.id,\n        title: typeof dealRow.title === 'string' ? dealRow.title : '',\n        description: dealRow.description ?? null,\n        status: dealRow.status ?? null,\n        pipelineId: dealRow.pipelineId ?? null,\n        pipelineStageId: dealRow.pipelineStageId ?? null,\n        valueAmount: dealRow.valueAmount ?? null,\n        valueCurrency: dealRow.valueCurrency ?? null,\n        probability: dealRow.probability ?? null,\n        ownerUserId: dealRow.ownerUserId ?? null,\n        expectedCloseAt: toIsoDeal(dealRow.expectedCloseAt),\n        source: dealRow.source ?? null,\n        organizationId: dealRow.organizationId ?? null,\n        tenantId: dealRow.tenantId ?? null,\n        createdAt: toIsoDeal(dealRow.createdAt),\n        updatedAt: toIsoDeal(dealRow.updatedAt),\n      },\n      customFields,\n      related,\n    }\n  },\n}\n\n/**\n * Mutation tool: move a deal to a different pipeline stage. Step 5.13 \u2014 first\n * mutation-capable flow on the pending-action contract.\n *\n * Accepts either `toPipelineStageId` (UUID \u2014 preferred, tenant-scoped stage\n * record) or `toStage` (free-form string that maps to `CustomerDeal.status`\n * for pipeline roots like `open`/`won`/`lost`). Exactly one must be provided.\n *\n * The handler delegates to the existing `customers.deals.update` command so\n * all side effects (audit log, `customers.deal.updated` event, query index\n * refresh, notifications) stay identical to a direct API write.\n */\n// LLMs frequently emit `\"\"` for \"not provided\" \u2014 coerce blanks (and surrounding\n// whitespace) to `undefined` BEFORE the per-field validators run so the\n// `.uuid()` check on `toPipelineStageId` does not blow up on an empty string\n// the caller actually meant as \"skip this field\".\nconst blankToUndefined = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length === 0 ? undefined : trimmed\n}\n\nconst updateDealStageInput = z\n  .object({\n    dealId: z.string().uuid().describe('Deal id (UUID) to update.'),\n    toPipelineStageId: z\n      .preprocess(blankToUndefined, z.string().uuid().optional())\n      .describe('Target pipeline stage id (UUID). Preferred \u2014 tenant-scoped stage record.'),\n    toStage: z\n      .preprocess(blankToUndefined, z.string().min(1).max(50).optional())\n      .describe(\n        'Target status slug (e.g. \"open\", \"won\", \"lost\"). Used when the deal does not belong to a managed pipeline.',\n      ),\n  })\n  .refine(\n    (value) => Boolean(value.toPipelineStageId) !== Boolean(value.toStage),\n    {\n      message: 'Provide exactly one of toPipelineStageId or toStage.',\n      path: ['toPipelineStageId'],\n    },\n  )\n\ntype UpdateDealStageInput = z.infer<typeof updateDealStageInput>\n\nfunction recordVersionFromUpdatedAt(updatedAt: Date | null | undefined): string | null {\n  if (!updatedAt) return null\n  const value = updatedAt instanceof Date ? updatedAt : new Date(updatedAt)\n  if (Number.isNaN(value.getTime())) return null\n  return value.toISOString()\n}\n\nfunction titleStatus(value: string | null | undefined): string | undefined {\n  if (!value) return undefined\n  return value\n    .split(/[_\\s-]+/)\n    .filter(Boolean)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n    .join(' ')\n}\n\nasync function loadDealWithStage(\n  em: EntityManager,\n  ctx: CustomersToolContext,\n  tenantId: string,\n  dealId: string,\n): Promise<CustomerDeal | null> {\n  const where: Record<string, unknown> = { id: dealId, tenantId, deletedAt: null }\n  if (ctx.organizationId) where.organizationId = ctx.organizationId\n  const deal = await findOneWithDecryption<CustomerDeal>(\n    em,\n    CustomerDeal,\n    where as FilterQuery<CustomerDeal>,\n    undefined,\n    buildScope(ctx, tenantId),\n  )\n  if (!deal || deal.tenantId !== tenantId) return null\n  if (ctx.organizationId && deal.organizationId !== ctx.organizationId) return null\n  return deal\n}\n\nasync function loadPipelineStage(\n  em: EntityManager,\n  ctx: CustomersToolContext,\n  tenantId: string,\n  stageId: string,\n  organizationId: string,\n): Promise<CustomerPipelineStage | null> {\n  return findOneWithDecryption<CustomerPipelineStage>(\n    em,\n    CustomerPipelineStage,\n    {\n      id: stageId,\n      tenantId,\n      organizationId,\n    },\n    undefined,\n    buildScope(ctx, tenantId),\n  )\n}\n\nconst updateDealStageTool: CustomersAiToolDefinition = {\n  name: 'customers.update_deal_stage',\n  displayName: 'Update deal stage',\n  description:\n    'Move a deal to a different pipeline stage (by stage id) or change its top-level status (e.g. \"open\", \"won\", \"lost\"). Mutation tool \u2014 flows through the AI pending-action approval gate.',\n  inputSchema: updateDealStageInput as z.ZodType<unknown>,\n  requiredFeatures: ['customers.deals.manage'],\n  tags: ['write', 'customers'],\n  isMutation: true,\n  loadBeforeRecord: async (rawInput, ctx): Promise<CustomersToolLoadBeforeSingleRecord | null> => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input: UpdateDealStageInput = updateDealStageInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const deal = await loadDealWithStage(em, ctx, tenantId, input.dealId)\n    if (!deal) return null\n    let afterStatus = deal.status ?? null\n    let afterPipelineStageId = deal.pipelineStageId ?? null\n    let afterPipelineStageLabel = deal.pipelineStage ?? null\n    if (input.toPipelineStageId) {\n      const organizationId = deal.organizationId ?? ctx.organizationId ?? null\n      const stage = organizationId\n        ? await loadPipelineStage(em, ctx, tenantId, input.toPipelineStageId, organizationId)\n        : null\n      afterPipelineStageId = input.toPipelineStageId\n      afterPipelineStageLabel = stage?.label ?? input.toPipelineStageId\n    } else if (input.toStage) {\n      afterStatus = input.toStage\n      // The update command derives a closure outcome from terminal status spellings and\n      // relocates the deal to the pipeline's terminal stage (#5107) \u2014 preview that same\n      // projection so the approval card states the full blast radius.\n      const organizationId = deal.organizationId ?? ctx.organizationId ?? null\n      const outcome = dealClosureOutcomeFromStatus(input.toStage)\n      if (outcome && organizationId) {\n        const terminalStage = await loadClosurePipelineStageSnapshot(em, {\n          pipelineId: deal.pipelineId ?? null,\n          closureOutcome: outcome,\n          tenantId,\n          organizationId,\n        })\n        if (terminalStage) {\n          afterPipelineStageId = terminalStage.id\n          afterPipelineStageLabel = terminalStage.label\n        }\n      }\n    }\n    const beforeStatus = deal.status ?? null\n    const beforePipelineStageId = deal.pipelineStageId ?? null\n    const beforePipelineStageLabel = deal.pipelineStage ?? beforePipelineStageId\n    const beforeClosureOutcome = deal.closureOutcome ?? null\n    const beforeLossReasonId = deal.lossReasonId ?? null\n    const beforeLossNotes = deal.lossNotes ?? null\n    // Mirror the update command exactly (#5107): a status-only write derives the closure\n    // outcome for terminal spellings, clears outcome plus loss columns for non-closed\n    // non-terminal ones (reopen), and leaves `closed` and stage-only writes untouched.\n    // `toStage` is free-form model text, so canonicalize before the `closed` check \u2014 the\n    // command does the same, and the two must stay in lockstep or the approval card would\n    // preview a different write than the one that lands.\n    const requestedOutcome = dealClosureOutcomeFromStatus(input.toStage)\n    const clearsClosure =\n      input.toPipelineStageId === undefined &&\n      input.toStage !== undefined &&\n      !requestedOutcome &&\n      !isClosedDealStatus(canonicalDealStatus(input.toStage))\n    const afterClosureOutcome = clearsClosure\n      ? null\n      : requestedOutcome ?? beforeClosureOutcome\n    const closureOutcomeCleared = beforeClosureOutcome !== null && afterClosureOutcome === null\n    const afterLossReasonId = closureOutcomeCleared ? null : beforeLossReasonId\n    const afterLossNotes = closureOutcomeCleared ? null : beforeLossNotes\n    return {\n      recordId: deal.id,\n      entityType: 'customers.deal',\n      recordVersion: recordVersionFromUpdatedAt(deal.updatedAt),\n      before: {\n        status: beforeStatus,\n        pipelineStageId: beforePipelineStageId,\n        closureOutcome: beforeClosureOutcome,\n        lossReasonId: beforeLossReasonId,\n        lossNotes: beforeLossNotes,\n      },\n      after: {\n        status: afterStatus,\n        pipelineStageId: afterPipelineStageId,\n        closureOutcome: afterClosureOutcome,\n        lossReasonId: afterLossReasonId,\n        lossNotes: afterLossNotes,\n      },\n      display: {\n        fieldLabels: {\n          status: 'Status',\n          pipelineStageId: 'Pipeline stage',\n          closureOutcome: 'Closure outcome',\n          lossReasonId: 'Loss reason',\n          lossNotes: 'Loss notes',\n        },\n        before: {\n          ...(beforeStatus ? { status: titleStatus(beforeStatus) } : {}),\n          ...(beforePipelineStageLabel ? { pipelineStageId: beforePipelineStageLabel } : {}),\n          ...(beforeClosureOutcome ? { closureOutcome: titleStatus(beforeClosureOutcome) } : {}),\n          ...(beforeLossReasonId ? { lossReasonId: beforeLossReasonId } : {}),\n          ...(beforeLossNotes ? { lossNotes: beforeLossNotes } : {}),\n        },\n        after: {\n          ...(afterStatus ? { status: titleStatus(afterStatus) } : {}),\n          ...(afterPipelineStageLabel ? { pipelineStageId: afterPipelineStageLabel } : {}),\n          ...(afterClosureOutcome\n            ? { closureOutcome: titleStatus(afterClosureOutcome) }\n            : closureOutcomeCleared\n              ? { closureOutcome: '\u2014' }\n              : {}),\n          ...(afterLossReasonId ? { lossReasonId: afterLossReasonId } : {}),\n          ...(afterLossNotes ? { lossNotes: afterLossNotes } : {}),\n        },\n      },\n    }\n  },\n  handler: async (rawInput, ctx) => {\n    const { tenantId } = assertTenantScope(ctx)\n    const input: UpdateDealStageInput = updateDealStageInput.parse(rawInput)\n    const em = resolveEm(ctx)\n    const deal = await loadDealWithStage(em, ctx, tenantId, input.dealId)\n    if (!deal) {\n      throw new Error(`Deal \"${input.dealId}\" is not accessible to the caller.`)\n    }\n    const organizationId = deal.organizationId\n    if (!organizationId) {\n      throw new Error(`Deal \"${input.dealId}\" has no organization scope.`)\n    }\n\n    const before = {\n      status: deal.status ?? null,\n      pipelineStage: deal.pipelineStage ?? null,\n      pipelineStageId: deal.pipelineStageId ?? null,\n    }\n\n    const body: Record<string, unknown> = {\n      id: deal.id,\n      tenantId,\n      organizationId,\n    }\n    if (input.toPipelineStageId) {\n      const stage = await loadPipelineStage(em, ctx, tenantId, input.toPipelineStageId, organizationId)\n      if (!stage) {\n        throw new Error('Pipeline stage not found.')\n      }\n      body.pipelineStageId = input.toPipelineStageId\n    } else if (input.toStage) {\n      body.status = input.toStage\n    }\n\n    const runner = createAiApiOperationRunner(ctx as unknown as AiToolExecutionContext)\n    const response = await runner.run({\n      method: 'PUT',\n      path: '/customers/deals',\n      body,\n    })\n    if (!response.success) {\n      throw new Error(response.error ?? `Failed to update deal \"${deal.id}\"`)\n    }\n\n    const after = await loadDealWithStage(em, ctx, tenantId, deal.id)\n    return {\n      recordId: deal.id,\n      commandName: 'customers.deals.update',\n      before,\n      after: after\n        ? {\n            status: after.status ?? null,\n            pipelineStage: after.pipelineStage ?? null,\n            pipelineStageId: after.pipelineStageId ?? null,\n          }\n        : null,\n    }\n  },\n}\n\nexport const dealsAiTools: CustomersAiToolDefinition[] = [listDealsTool, getDealTool, updateDealStageTool]\n\nexport default dealsAiTools\n"],
+  "mappings": "AAiBA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,0BAA0B;AACxD;AAAA,EACE;AAAA,OAIK;AAEP,SAAS,UAAU,KAAmE;AACpF,SAAO,IAAI,UAAU,QAAuB,IAAI;AAClD;AAEA,SAAS,WAAW,KAAoD,UAAkB;AACxF,SAAO,EAAE,UAAU,gBAAgB,IAAI,eAAe;AACxD;AAEA,MAAM,iBAAiB,EACpB,OAAO;AAAA,EACN,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,wFAAwF;AAAA,EACjI,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,+CAA+C;AAAA,EAC3G,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACzF,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EACpG,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,qDAAqD;AAAA,EACtG,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,2CAA2C;AAAA,EAClG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,qDAAqD;AAC9F,CAAC,EACA,YAAY;AA2Cf,MAAM,gBAAgB,sBAA6E;AAAA,EACjG,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,aAAa,CAAC,OAAO,QAAQ;AAC3B,sBAAkB,GAAsC;AACxD,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAO,KAAK,MAAM,SAAS,KAAK,IAAI;AAE1C,UAAM,QAAsE;AAAA,MAC1E;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,MAAM,GAAG,KAAK,EAAG,OAAM,SAAS,MAAM,EAAE,KAAK;AACjD,QAAI,MAAM,SAAU,OAAM,WAAW,MAAM;AAC3C,QAAI,MAAM,UAAW,OAAM,YAAY,MAAM;AAC7C,QAAI,MAAM,gBAAiB,OAAM,kBAAkB,MAAM;AACzD,QAAI,MAAM,OAAQ,OAAM,SAAS,MAAM;AAEvC,UAAM,YAAmC;AAAA,MACvC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,aAAa,CAAC,UAAU,UAAU;AAChC,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,SAAS,MAAM,UAAU;AAC/B,UAAM,OAAQ,SAAS,QAAQ,CAAC;AAChC,UAAM,WAA+B,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAC/E,WAAO;AAAA,MACL,OAAO,SAAS,IAAI,CAAC,QAAQ;AAC3B,cAAM,mBAAmB,IAAI,qBAAqB,IAAI,mBAAmB;AACzE,cAAM,kBAAkB,mBAAmB,IAAI,KAAK,OAAO,gBAAgB,CAAC,EAAE,YAAY,IAAI;AAC9F,cAAM,eAAe,IAAI,cAAc,IAAI,aAAa;AACxD,cAAM,YAAY,eAAe,IAAI,KAAK,OAAO,YAAY,CAAC,EAAE,YAAY,IAAI;AAChF,eAAO;AAAA,UACL,IAAI,IAAI;AAAA,UACR,OAAO,IAAI,SAAS;AAAA,UACpB,aAAa,IAAI,eAAe;AAAA,UAChC,QAAQ,IAAI,UAAU;AAAA,UACtB,YAAY,IAAI,eAAe,IAAI,cAAc;AAAA,UACjD,iBAAiB,IAAI,qBAAqB,IAAI,mBAAmB;AAAA,UACjE,aAAa,IAAI,gBAAgB,IAAI,eAAe;AAAA,UACpD,eAAe,IAAI,kBAAkB,IAAI,iBAAiB;AAAA,UAC1D,aAAa,IAAI,eAAe;AAAA,UAChC,aAAa,IAAI,iBAAiB,IAAI,eAAe;AAAA,UACrD;AAAA,UACA,QAAQ,IAAI,UAAU;AAAA,UACtB,gBAAgB,IAAI,mBAAmB,IAAI,kBAAkB;AAAA,UAC7D,UAAU,IAAI,aAAa,IAAI,YAAY;AAAA,UAC3C;AAAA,QACF;AAAA,MACF,CAAC;AAAA,MACD,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAAA;AAAA;AAAA,MAGrD,eAAgB,KAAqC,kBAAkB;AAAA,MACvE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,iBAAiB;AAAA,EACpD,gBAAgB,EACb,QAAQ,EACR,SAAS,EACT,SAAS,yFAAyF;AACvG,CAAC;AAID,SAAS,UAAU,OAA+B;AAChD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KAAK,iBAAiB,OAAO,QAAQ,IAAI,KAAK,OAAO,KAAK,CAAC;AACjE,MAAI,OAAO,MAAM,GAAG,QAAQ,CAAC,EAAG,QAAO;AACvC,SAAO,GAAG,YAAY;AACxB;AAEA,MAAM,cAAyC;AAAA,EAC7C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,sBAAsB;AAAA,EACzC,MAAM,CAAC,QAAQ,WAAW;AAAA,EAC1B,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,UAAU,UAAU,IAAI,kBAAkB,GAAG;AACrD,SAAK;AACL,UAAM,QAAsB,aAAa,MAAM,QAAQ;AACvD,UAAM,iBAAiB,CAAC,CAAC,MAAM;AAC/B,UAAM,SAAS,2BAA2B,GAAwC;AAElF,UAAM,iBAAiB,MAAM,OAAO,IAA6B;AAAA,MAC/D,QAAQ;AAAA,MACR,MAAM,oBAAoB,MAAM,MAAM;AAAA,IACxC,CAAC;AACD,QAAI,CAAC,eAAe,SAAS;AAC3B,UAAI,eAAe,eAAe,OAAO,eAAe,eAAe,KAAK;AAC1E,eAAO,EAAE,OAAO,OAAgB,QAAQ,MAAM,OAAO;AAAA,MACvD;AACA,YAAM,IAAI,MAAM,eAAe,SAAS,wBAAwB,MAAM,MAAM,EAAE;AAAA,IAChF;AACA,UAAM,SAAU,eAAe,QAAQ,CAAC;AACxC,UAAM,UAAW,OAAO,QAAQ;AAChC,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,OAAO,OAAgB,QAAQ,MAAM,OAAO;AAAA,IACvD;AACA,UAAM,eAAgB,OAAO,gBAAgB,CAAC;AAC9C,UAAM,aAAa,MAAM,QAAQ,OAAO,MAAM,IAAK,OAAO,SAA4C,CAAC;AACvG,UAAM,gBAAgB,MAAM,QAAQ,OAAO,SAAS,IAC/C,OAAO,YACR,CAAC;AAEL,QAAI,UAA0C;AAC9C,QAAI,gBAAgB;AAClB,YAAM,CAAC,oBAAoB,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC/D,OAAO,IAAgE;AAAA,UACrE,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,GAAG,UAAU,KAAK,WAAW,cAAc,SAAS,OAAO;AAAA,QAClG,CAAC;AAAA,QACD,OAAO,IAAgE;AAAA,UACrE,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,OAAO,EAAE,QAAQ,MAAM,QAAQ,MAAM,GAAG,UAAU,IAAI;AAAA,QACxD,CAAC;AAAA,MACH,CAAC;AACD,YAAM,aACJ,mBAAmB,WAAW,MAAM,QAAQ,mBAAmB,MAAM,KAAK,IACrE,mBAAmB,KAAM,QAC1B,CAAC;AACP,YAAM,WACJ,iBAAiB,WAAW,MAAM,QAAQ,iBAAiB,MAAM,KAAK,IACjE,iBAAiB,KAAM,QACxB,CAAC;AAEP,gBAAU;AAAA,QACR,YAAY,WAAW,IAAI,CAAC,cAAc;AAAA,UACxC,IAAI,SAAS;AAAA,UACb,cAAc,SAAS,gBAAgB,SAAS,iBAAiB;AAAA,UACjE,SAAS,SAAS,WAAW;AAAA,UAC7B,MAAM,SAAS,QAAQ;AAAA,UACvB,YAAY,UAAU,SAAS,cAAc,SAAS,WAAW;AAAA,UACjE,WAAW,UAAU,SAAS,aAAa,SAAS,UAAU;AAAA,QAChE,EAAE;AAAA,QACF,OAAO,SAAS,IAAI,CAAC,aAAa;AAAA,UAChC,IAAI,QAAQ;AAAA,UACZ,MAAM,QAAQ;AAAA,UACd,cAAc,QAAQ,gBAAgB,QAAQ,kBAAkB;AAAA,UAChE,WAAW,UAAU,QAAQ,aAAa,QAAQ,UAAU;AAAA,QAC9D,EAAE;AAAA,QACF,QAAQ,WACL,IAAI,CAAC,WAAW;AACf,cAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,gBAAM,KAAK,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACvD,cAAI,CAAC,GAAI,QAAO;AAChB,gBAAM,WAAW,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACzE,gBAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,gBAAM,QAMF;AAAA,YACF;AAAA,YACA,aAAa;AAAA,YACb,cAAc,YAAY,SAAS,SAAS,GAAG,IAAI,WAAW;AAAA,YAC9D,cAAc,YAAY,CAAC,SAAS,SAAS,GAAG,IAAI,WAAW;AAAA,YAC/D,iBAAiB;AAAA,UACnB;AACA,iBAAO;AAAA,QACT,CAAC,EACA;AAAA,UACC,CAAC,UAMI,UAAU;AAAA,QACjB;AAAA,QACF,WAAW,cACR,IAAI,CAAC,YAAY;AAChB,cAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,gBAAM,KAAK,OAAO,QAAQ,OAAO,WAAW,QAAQ,KAAK;AACzD,cAAI,CAAC,GAAI,QAAO;AAChB,gBAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAClE,gBAAM,QAKF;AAAA,YACF;AAAA,YACA,aAAa;AAAA,YACb,cAAc;AAAA,YACd,cAAc;AAAA,UAChB;AACA,iBAAO;AAAA,QACT,CAAC,EACA;AAAA,UACC,CAAC,UAKI,UAAU;AAAA,QACjB;AAAA,MACJ;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM;AAAA,QACJ,IAAI,QAAQ;AAAA,QACZ,OAAO,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AAAA,QAC3D,aAAa,QAAQ,eAAe;AAAA,QACpC,QAAQ,QAAQ,UAAU;AAAA,QAC1B,YAAY,QAAQ,cAAc;AAAA,QAClC,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,aAAa,QAAQ,eAAe;AAAA,QACpC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,aAAa,QAAQ,eAAe;AAAA,QACpC,aAAa,QAAQ,eAAe;AAAA,QACpC,iBAAiB,UAAU,QAAQ,eAAe;AAAA,QAClD,QAAQ,QAAQ,UAAU;AAAA,QAC1B,gBAAgB,QAAQ,kBAAkB;AAAA,QAC1C,UAAU,QAAQ,YAAY;AAAA,QAC9B,WAAW,UAAU,QAAQ,SAAS;AAAA,QACtC,WAAW,UAAU,QAAQ,SAAS;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAkBA,MAAM,mBAAmB,CAAC,UAA4B;AACpD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,IAAI,SAAY;AAC5C;AAEA,MAAM,uBAAuB,EAC1B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,2BAA2B;AAAA,EAC9D,mBAAmB,EAChB,WAAW,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EACzD,SAAS,+EAA0E;AAAA,EACtF,SAAS,EACN,WAAW,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,EACjE;AAAA,IACC;AAAA,EACF;AACJ,CAAC,EACA;AAAA,EACC,CAAC,UAAU,QAAQ,MAAM,iBAAiB,MAAM,QAAQ,MAAM,OAAO;AAAA,EACrE;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,mBAAmB;AAAA,EAC5B;AACF;AAIF,SAAS,2BAA2B,WAAmD;AACrF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,QAAQ,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS;AACxE,MAAI,OAAO,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AAC1C,SAAO,MAAM,YAAY;AAC3B;AAEA,SAAS,YAAY,OAAsD;AACzE,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,MACJ,MAAM,SAAS,EACf,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,EAC1D,KAAK,GAAG;AACb;AAEA,eAAe,kBACb,IACA,KACA,UACA,QAC8B;AAC9B,QAAM,QAAiC,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC/E,MAAI,IAAI,eAAgB,OAAM,iBAAiB,IAAI;AACnD,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,KAAK,QAAQ;AAAA,EAC1B;AACA,MAAI,CAAC,QAAQ,KAAK,aAAa,SAAU,QAAO;AAChD,MAAI,IAAI,kBAAkB,KAAK,mBAAmB,IAAI,eAAgB,QAAO;AAC7E,SAAO;AACT;AAEA,eAAe,kBACb,IACA,KACA,UACA,SACA,gBACuC;AACvC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,IACA,WAAW,KAAK,QAAQ;AAAA,EAC1B;AACF;AAEA,MAAM,sBAAiD;AAAA,EACrD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,aACE;AAAA,EACF,aAAa;AAAA,EACb,kBAAkB,CAAC,wBAAwB;AAAA,EAC3C,MAAM,CAAC,SAAS,WAAW;AAAA,EAC3B,YAAY;AAAA,EACZ,kBAAkB,OAAO,UAAU,QAA6D;AAC9F,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAA8B,qBAAqB,MAAM,QAAQ;AACvE,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,OAAO,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,MAAM;AACpE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,cAAc,KAAK,UAAU;AACjC,QAAI,uBAAuB,KAAK,mBAAmB;AACnD,QAAI,0BAA0B,KAAK,iBAAiB;AACpD,QAAI,MAAM,mBAAmB;AAC3B,YAAM,iBAAiB,KAAK,kBAAkB,IAAI,kBAAkB;AACpE,YAAM,QAAQ,iBACV,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,mBAAmB,cAAc,IAClF;AACJ,6BAAuB,MAAM;AAC7B,gCAA0B,OAAO,SAAS,MAAM;AAAA,IAClD,WAAW,MAAM,SAAS;AACxB,oBAAc,MAAM;AAIpB,YAAM,iBAAiB,KAAK,kBAAkB,IAAI,kBAAkB;AACpE,YAAM,UAAU,6BAA6B,MAAM,OAAO;AAC1D,UAAI,WAAW,gBAAgB;AAC7B,cAAM,gBAAgB,MAAM,iCAAiC,IAAI;AAAA,UAC/D,YAAY,KAAK,cAAc;AAAA,UAC/B,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,QACF,CAAC;AACD,YAAI,eAAe;AACjB,iCAAuB,cAAc;AACrC,oCAA0B,cAAc;AAAA,QAC1C;AAAA,MACF;AAAA,IACF;AACA,UAAM,eAAe,KAAK,UAAU;AACpC,UAAM,wBAAwB,KAAK,mBAAmB;AACtD,UAAM,2BAA2B,KAAK,iBAAiB;AACvD,UAAM,uBAAuB,KAAK,kBAAkB;AACpD,UAAM,qBAAqB,KAAK,gBAAgB;AAChD,UAAM,kBAAkB,KAAK,aAAa;AAO1C,UAAM,mBAAmB,6BAA6B,MAAM,OAAO;AACnE,UAAM,gBACJ,MAAM,sBAAsB,UAC5B,MAAM,YAAY,UAClB,CAAC,oBACD,CAAC,mBAAmB,oBAAoB,MAAM,OAAO,CAAC;AACxD,UAAM,sBAAsB,gBACxB,OACA,oBAAoB;AACxB,UAAM,wBAAwB,yBAAyB,QAAQ,wBAAwB;AACvF,UAAM,oBAAoB,wBAAwB,OAAO;AACzD,UAAM,iBAAiB,wBAAwB,OAAO;AACtD,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,YAAY;AAAA,MACZ,eAAe,2BAA2B,KAAK,SAAS;AAAA,MACxD,QAAQ;AAAA,QACN,QAAQ;AAAA,QACR,iBAAiB;AAAA,QACjB,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA,OAAO;AAAA,QACL,QAAQ;AAAA,QACR,iBAAiB;AAAA,QACjB,gBAAgB;AAAA,QAChB,cAAc;AAAA,QACd,WAAW;AAAA,MACb;AAAA,MACA,SAAS;AAAA,QACP,aAAa;AAAA,UACX,QAAQ;AAAA,UACR,iBAAiB;AAAA,UACjB,gBAAgB;AAAA,UAChB,cAAc;AAAA,UACd,WAAW;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,UACN,GAAI,eAAe,EAAE,QAAQ,YAAY,YAAY,EAAE,IAAI,CAAC;AAAA,UAC5D,GAAI,2BAA2B,EAAE,iBAAiB,yBAAyB,IAAI,CAAC;AAAA,UAChF,GAAI,uBAAuB,EAAE,gBAAgB,YAAY,oBAAoB,EAAE,IAAI,CAAC;AAAA,UACpF,GAAI,qBAAqB,EAAE,cAAc,mBAAmB,IAAI,CAAC;AAAA,UACjE,GAAI,kBAAkB,EAAE,WAAW,gBAAgB,IAAI,CAAC;AAAA,QAC1D;AAAA,QACA,OAAO;AAAA,UACL,GAAI,cAAc,EAAE,QAAQ,YAAY,WAAW,EAAE,IAAI,CAAC;AAAA,UAC1D,GAAI,0BAA0B,EAAE,iBAAiB,wBAAwB,IAAI,CAAC;AAAA,UAC9E,GAAI,sBACA,EAAE,gBAAgB,YAAY,mBAAmB,EAAE,IACnD,wBACE,EAAE,gBAAgB,SAAI,IACtB,CAAC;AAAA,UACP,GAAI,oBAAoB,EAAE,cAAc,kBAAkB,IAAI,CAAC;AAAA,UAC/D,GAAI,iBAAiB,EAAE,WAAW,eAAe,IAAI,CAAC;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS,OAAO,UAAU,QAAQ;AAChC,UAAM,EAAE,SAAS,IAAI,kBAAkB,GAAG;AAC1C,UAAM,QAA8B,qBAAqB,MAAM,QAAQ;AACvE,UAAM,KAAK,UAAU,GAAG;AACxB,UAAM,OAAO,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,MAAM;AACpE,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,MAAM,SAAS,MAAM,MAAM,oCAAoC;AAAA,IAC3E;AACA,UAAM,iBAAiB,KAAK;AAC5B,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,SAAS,MAAM,MAAM,8BAA8B;AAAA,IACrE;AAEA,UAAM,SAAS;AAAA,MACb,QAAQ,KAAK,UAAU;AAAA,MACvB,eAAe,KAAK,iBAAiB;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,IAC3C;AAEA,UAAM,OAAgC;AAAA,MACpC,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,IACF;AACA,QAAI,MAAM,mBAAmB;AAC3B,YAAM,QAAQ,MAAM,kBAAkB,IAAI,KAAK,UAAU,MAAM,mBAAmB,cAAc;AAChG,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AACA,WAAK,kBAAkB,MAAM;AAAA,IAC/B,WAAW,MAAM,SAAS;AACxB,WAAK,SAAS,MAAM;AAAA,IACtB;AAEA,UAAM,SAAS,2BAA2B,GAAwC;AAClF,UAAM,WAAW,MAAM,OAAO,IAAI;AAAA,MAChC,QAAQ;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AACD,QAAI,CAAC,SAAS,SAAS;AACrB,YAAM,IAAI,MAAM,SAAS,SAAS,0BAA0B,KAAK,EAAE,GAAG;AAAA,IACxE;AAEA,UAAM,QAAQ,MAAM,kBAAkB,IAAI,KAAK,UAAU,KAAK,EAAE;AAChE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,aAAa;AAAA,MACb;AAAA,MACA,OAAO,QACH;AAAA,QACE,QAAQ,MAAM,UAAU;AAAA,QACxB,eAAe,MAAM,iBAAiB;AAAA,QACtC,iBAAiB,MAAM,mBAAmB;AAAA,MAC5C,IACA;AAAA,IACN;AAAA,EACF;AACF;AAEO,MAAM,eAA4C,CAAC,eAAe,aAAa,mBAAmB;AAEzG,IAAO,qBAAQ;",
   "names": []
 }

package/dist/modules/customers/api/deals/aggregate/route.js

@@ -9,6 +9,7 @@ import { parseBooleanFromUnknown } from "@open-mercato/shared/lib/boolean";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
 import { isTenantDataEncryptionEnabled } from "@open-mercato/shared/lib/encryption/toggles";
 import { fetchStuckDealIds } from "../../../lib/stuckDeals.js";
+import { expandDealStatusAliases } from "../../../lib/dealStatus.js";
 import { findMatchingEntityIdsBySearchTokensAcrossSources } from "../../utils.js";
 import { E } from "../../../../../generated/entities.ids.generated.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -19,7 +20,7 @@ const metadata = {
 const querySchema = z.object({
   pipelineId: z.string().uuid().optional(),
   search: z.string().optional(),
-  status: z.array(z.enum(["open", "closed", "win", "loose"])).optional(),
+  status: z.array(z.string().max(50)).max(20).optional(),
   ownerUserId: z.array(z.string().uuid()).optional(),
   personId: z.array(z.string().uuid()).optional(),
   companyId: z.array(z.string().uuid()).optional(),
@@ -177,9 +178,10 @@ async function GET(req) {
     }
   }
   if (parsed.data.status && parsed.data.status.length) {
-    const placeholders = parsed.data.status.map(() => "?").join(",");
+    const expandedStatuses = expandDealStatusAliases(parsed.data.status);
+    const placeholders = expandedStatuses.map(() => "?").join(",");
     where.push(`status IN (${placeholders})`);
-    values.push(...parsed.data.status);
+    values.push(...expandedStatuses);
   }
   if (parsed.data.ownerUserId && parsed.data.ownerUserId.length) {
     const placeholders = parsed.data.ownerUserId.map(() => "?").join(",");
@@ -195,7 +197,12 @@ async function GET(req) {
     values.push(parsed.data.expectedCloseAtTo);
   }
   if (parsed.data.isOverdue) {
-    where.push("expected_close_at < CURRENT_DATE AND status = 'open'");
+    const hasCallerStatus = !!parsed.data.status?.length;
+    if (hasCallerStatus) {
+      where.push("expected_close_at < CURRENT_DATE");
+    } else {
+      where.push("expected_close_at < CURRENT_DATE AND status = 'open'");
+    }
   }
   if (parsed.data.isStuck) {
     const stuckIds = await fetchStuckDealIds(em, orgFilterIds[0], effectiveTenantId);