@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/resources/commands/activities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/resources/commands/activities.ts"],
-  "sourcesContent": ["import { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport {\n  loadCustomFieldSnapshot,\n  diffCustomFieldChanges,\n  buildCustomFieldResetMap,\n  type CustomFieldChangeSet,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'\nimport { ResourcesResourceActivity } from '../data/entities'\nimport {\n  resourcesResourceActivityCreateSchema,\n  resourcesResourceActivityUpdateSchema,\n  type ResourcesResourceActivityCreateInput,\n  type ResourcesResourceActivityUpdateInput,\n} from '../data/validators'\nimport { resourcesResourceActivityCrudEvents } from '../lib/crud'\nimport { ensureOrganizationScope, ensureTenantScope, extractUndoPayload, requireResource, resolveResourceAuthorUserId } from './shared'\nimport { E } from '#generated/entities.ids.generated'\n\nconst ACTIVITY_ENTITY_ID = E.resources.resources_resource_activity\nconst activityCrudIndexer: CrudIndexerConfig<ResourcesResourceActivity> = {\n  entityType: E.resources.resources_resource_activity,\n}\n\ntype ActivitySnapshot = {\n  activity: {\n    id: string\n    organizationId: string\n    tenantId: string\n    resourceId: string\n    activityType: string\n    subject: string | null\n    body: string | null\n    occurredAt: Date | null\n    authorUserId: string | null\n    appearanceIcon: string | null\n    appearanceColor: string | null\n  }\n  custom?: Record<string, unknown>\n}\n\ntype ActivityUndoPayload = {\n  before?: ActivitySnapshot | null\n  after?: ActivitySnapshot | null\n}\n\ntype ActivityChangeMap = Record<string, { from: unknown; to: unknown }> & {\n  custom?: CustomFieldChangeSet\n}\n\nasync function loadActivitySnapshot(em: EntityManager, id: string): Promise<ActivitySnapshot | null> {\n  const activity = await em.findOne(ResourcesResourceActivity, { id })\n  if (!activity) return null\n  const custom = await loadCustomFieldSnapshot(em, {\n    entityId: ACTIVITY_ENTITY_ID,\n    recordId: activity.id,\n    tenantId: activity.tenantId,\n    organizationId: activity.organizationId,\n  })\n  return {\n    activity: {\n      id: activity.id,\n      organizationId: activity.organizationId,\n      tenantId: activity.tenantId,\n      resourceId: typeof activity.resource === 'string' ? activity.resource : activity.resource.id,\n      activityType: activity.activityType,\n      subject: activity.subject ?? null,\n      body: activity.body ?? null,\n      occurredAt: activity.occurredAt ?? null,\n      authorUserId: activity.authorUserId ?? null,\n      appearanceIcon: activity.appearanceIcon ?? null,\n      appearanceColor: activity.appearanceColor ?? null,\n    },\n    custom,\n  }\n}\n\nasync function setActivityCustomFields(\n  ctx: CommandRuntimeContext,\n  activityId: string,\n  organizationId: string,\n  tenantId: string,\n  values: Record<string, unknown>,\n) {\n  if (!values || !Object.keys(values).length) return\n  const de = (ctx.container.resolve('dataEngine') as DataEngine)\n  await setCustomFieldsIfAny({\n    dataEngine: de,\n    entityId: ACTIVITY_ENTITY_ID,\n    recordId: activityId,\n    organizationId,\n    tenantId,\n    values,\n    notify: false,\n  })\n}\n\nconst createActivityCommand: CommandHandler<ResourcesResourceActivityCreateInput, { activityId: string; authorUserId: string | null }> = {\n  id: 'resources.resource-activities.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(resourcesResourceActivityCreateSchema, rawInput)\n    ensureTenantScope(ctx, parsed.tenantId)\n    ensureOrganizationScope(ctx, parsed.organizationId)\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, parsed.entityId, 'Resource not found')\n    ensureTenantScope(ctx, resource.tenantId)\n    ensureOrganizationScope(ctx, resource.organizationId)\n    const normalizedAuthor = await resolveResourceAuthorUserId(em, parsed.authorUserId, ctx, {\n      tenantId: resource.tenantId,\n      organizationId: resource.organizationId,\n    })\n\n    const activity = em.create(ResourcesResourceActivity, {\n      organizationId: parsed.organizationId,\n      tenantId: parsed.tenantId,\n      resource,\n      activityType: parsed.activityType,\n      subject: parsed.subject ?? null,\n      body: parsed.body ?? null,\n      occurredAt: parsed.occurredAt ?? null,\n      authorUserId: normalizedAuthor,\n      appearanceIcon: parsed.appearanceIcon ?? null,\n      appearanceColor: parsed.appearanceColor ?? null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    em.persist(activity)\n    await em.flush()\n\n    await setActivityCustomFields(ctx, activity.id, parsed.organizationId, parsed.tenantId, custom)\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    return { activityId: activity.id, authorUserId: activity.authorUserId ?? null }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return await loadActivitySnapshot(em, result.activityId)\n  },\n  buildLog: async ({ result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const snapshot = await loadActivitySnapshot(em, result.activityId)\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.create', 'Create activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: result.activityId,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: snapshot?.activity?.resourceId ?? null,\n      tenantId: snapshot?.activity.tenantId ?? null,\n      organizationId: snapshot?.activity.organizationId ?? null,\n      snapshotAfter: snapshot ?? null,\n      payload: {\n        undo: {\n          after: snapshot ?? null,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const activityId = logEntry?.resourceId ?? null\n    if (!activityId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const existing = await em.findOne(ResourcesResourceActivity, { id: activityId })\n    if (existing) {\n      em.remove(existing)\n      await em.flush()\n    }\n  },\n  redo: async ({ logEntry, ctx }) => {\n    const after = resolveRedoSnapshot<ActivitySnapshot>(logEntry)\n    if (!after) {\n      throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for activity create' })\n    }\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, after.activity.resourceId, 'Resource not found')\n    let activity = await em.findOne(ResourcesResourceActivity, { id: after.activity.id })\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: after.activity.id,\n        organizationId: after.activity.organizationId,\n        tenantId: after.activity.tenantId,\n        resource,\n        activityType: after.activity.activityType,\n        subject: after.activity.subject,\n        body: after.activity.body,\n        occurredAt: after.activity.occurredAt,\n        authorUserId: after.activity.authorUserId,\n        appearanceIcon: after.activity.appearanceIcon,\n        appearanceColor: after.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = after.activity.activityType\n      activity.subject = after.activity.subject\n      activity.body = after.activity.body\n      activity.occurredAt = after.activity.occurredAt\n      activity.authorUserId = after.activity.authorUserId\n      activity.appearanceIcon = after.activity.appearanceIcon\n      activity.appearanceColor = after.activity.appearanceColor\n    }\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(after.custom, undefined)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n\n    return { activityId: activity.id, authorUserId: activity.authorUserId ?? null }\n  },\n}\n\nconst updateActivityCommand: CommandHandler<ResourcesResourceActivityUpdateInput, { activityId: string }> = {\n  id: 'resources.resource-activities.update',\n  async prepare(rawInput, ctx) {\n    const parsed = resourcesResourceActivityUpdateSchema.parse(rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const snapshot = await loadActivitySnapshot(em, parsed.id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(resourcesResourceActivityUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const activity = await em.findOne(ResourcesResourceActivity, { id: parsed.id })\n    if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })\n    ensureTenantScope(ctx, activity.tenantId)\n    ensureOrganizationScope(ctx, activity.organizationId)\n\n    if (parsed.entityId !== undefined) {\n      const resource = await requireResource(em, parsed.entityId, 'Resource not found')\n      ensureTenantScope(ctx, resource.tenantId)\n      ensureOrganizationScope(ctx, resource.organizationId)\n      activity.resource = resource\n    }\n    if (parsed.activityType !== undefined) activity.activityType = parsed.activityType\n    if (parsed.subject !== undefined) activity.subject = parsed.subject ?? null\n    if (parsed.body !== undefined) activity.body = parsed.body ?? null\n    if (parsed.occurredAt !== undefined) activity.occurredAt = parsed.occurredAt ?? null\n    if (parsed.appearanceIcon !== undefined) activity.appearanceIcon = parsed.appearanceIcon ?? null\n    if (parsed.appearanceColor !== undefined) activity.appearanceColor = parsed.appearanceColor ?? null\n\n    await em.flush()\n\n    await setActivityCustomFields(ctx, activity.id, activity.organizationId, activity.tenantId, custom)\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    return { activityId: activity.id }\n  },\n  buildLog: async ({ snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const before = snapshots.before as ActivitySnapshot | undefined\n    if (!before) return null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterSnapshot = await loadActivitySnapshot(em, before.activity.id)\n    const changes: ActivityChangeMap =\n      afterSnapshot && afterSnapshot.activity\n        ? buildChanges(\n            before.activity as Record<string, unknown>,\n            afterSnapshot.activity as Record<string, unknown>,\n            ['resourceId', 'activityType', 'subject', 'body', 'occurredAt', 'authorUserId', 'appearanceIcon', 'appearanceColor'],\n          )\n        : {}\n    const customChanges = diffCustomFieldChanges(before.custom, afterSnapshot?.custom)\n    if (Object.keys(customChanges).length) changes.custom = customChanges\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.update', 'Update activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: before.activity.id,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: before.activity.resourceId ?? null,\n      tenantId: before.activity.tenantId,\n      organizationId: before.activity.organizationId,\n      snapshotBefore: before,\n      snapshotAfter: afterSnapshot ?? null,\n      changes,\n      payload: {\n        undo: {\n          before,\n          after: afterSnapshot ?? null,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<ActivityUndoPayload>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    let activity = await em.findOne(ResourcesResourceActivity, { id: before.activity.id })\n    const resource = await requireResource(em, before.activity.resourceId, 'Resource not found')\n\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: before.activity.id,\n        organizationId: before.activity.organizationId,\n        tenantId: before.activity.tenantId,\n        resource,\n        activityType: before.activity.activityType,\n        subject: before.activity.subject,\n        body: before.activity.body,\n        occurredAt: before.activity.occurredAt,\n        authorUserId: before.activity.authorUserId,\n        appearanceIcon: before.activity.appearanceIcon,\n        appearanceColor: before.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = before.activity.activityType\n      activity.subject = before.activity.subject\n      activity.body = before.activity.body\n      activity.occurredAt = before.activity.occurredAt\n      activity.authorUserId = before.activity.authorUserId\n      activity.appearanceIcon = before.activity.appearanceIcon\n      activity.appearanceColor = before.activity.appearanceColor\n    }\n\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(before.custom, payload?.after?.custom)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n  },\n}\n\nconst deleteActivityCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, { activityId: string }> = {\n  id: 'resources.resource-activities.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Activity id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const snapshot = await loadActivitySnapshot(em, id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'Activity id required')\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const activity = await em.findOne(ResourcesResourceActivity, { id })\n    if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })\n    ensureTenantScope(ctx, activity.tenantId)\n    ensureOrganizationScope(ctx, activity.organizationId)\n    em.remove(activity)\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n    return { activityId: activity.id }\n  },\n  buildLog: async ({ snapshots }) => {\n    const before = snapshots.before as ActivitySnapshot | undefined\n    if (!before) return null\n    const { translate } = await resolveTranslations()\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.delete', 'Delete activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: before.activity.id,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: before.activity.resourceId ?? null,\n      tenantId: before.activity.tenantId,\n      organizationId: before.activity.organizationId,\n      snapshotBefore: before,\n      payload: {\n        undo: {\n          before,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<ActivityUndoPayload>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, before.activity.resourceId, 'Resource not found')\n    let activity = await em.findOne(ResourcesResourceActivity, { id: before.activity.id })\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: before.activity.id,\n        organizationId: before.activity.organizationId,\n        tenantId: before.activity.tenantId,\n        resource,\n        activityType: before.activity.activityType,\n        subject: before.activity.subject,\n        body: before.activity.body,\n        occurredAt: before.activity.occurredAt,\n        authorUserId: before.activity.authorUserId,\n        appearanceIcon: before.activity.appearanceIcon,\n        appearanceColor: before.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = before.activity.activityType\n      activity.subject = before.activity.subject\n      activity.body = before.activity.body\n      activity.occurredAt = before.activity.occurredAt\n      activity.authorUserId = before.activity.authorUserId\n      activity.appearanceIcon = before.activity.appearanceIcon\n      activity.appearanceColor = before.activity.appearanceColor\n    }\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(before.custom, undefined)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n  },\n}\n\nregisterCommand(createActivityCommand)\nregisterCommand(updateActivityCommand)\nregisterCommand(deleteActivityCommand)\n"],
-  "mappings": "AAAA,SAAS,uBAAuB;AAEhC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,2CAA2C;AACpD,SAAS,yBAAyB,mBAAmB,oBAAoB,iBAAiB,mCAAmC;AAC7H,SAAS,SAAS;AAElB,MAAM,qBAAqB,EAAE,UAAU;AACvC,MAAM,sBAAoE;AAAA,EACxE,YAAY,EAAE,UAAU;AAC1B;AA4BA,eAAe,qBAAqB,IAAmB,IAA8C;AACnG,QAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,GAAG,CAAC;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,IAC/C,UAAU;AAAA,IACV,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,EAC3B,CAAC;AACD,SAAO;AAAA,IACL,UAAU;AAAA,MACR,IAAI,SAAS;AAAA,MACb,gBAAgB,SAAS;AAAA,MACzB,UAAU,SAAS;AAAA,MACnB,YAAY,OAAO,SAAS,aAAa,WAAW,SAAS,WAAW,SAAS,SAAS;AAAA,MAC1F,cAAc,SAAS;AAAA,MACvB,SAAS,SAAS,WAAW;AAAA,MAC7B,MAAM,SAAS,QAAQ;AAAA,MACvB,YAAY,SAAS,cAAc;AAAA,MACnC,cAAc,SAAS,gBAAgB;AAAA,MACvC,gBAAgB,SAAS,kBAAkB;AAAA,MAC3C,iBAAiB,SAAS,mBAAmB;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBACb,KACA,YACA,gBACA,UACA,QACA;AACA,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,OAAQ;AAC5C,QAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAM,qBAAqB;AAAA,IACzB,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,MAAM,wBAAmI;AAAA,EACvI,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,uCAAuC,QAAQ;AAChG,sBAAkB,KAAK,OAAO,QAAQ;AACtC,4BAAwB,KAAK,OAAO,cAAc;AAElD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,UAAU,oBAAoB;AAChF,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AACpD,UAAM,mBAAmB,MAAM,4BAA4B,IAAI,OAAO,cAAc,KAAK;AAAA,MACvF,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAED,UAAM,WAAW,GAAG,OAAO,2BAA2B;AAAA,MACpD,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,MAAM,OAAO,QAAQ;AAAA,MACrB,YAAY,OAAO,cAAc;AAAA,MACjC,cAAc;AAAA,MACd,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,QAAQ;AACnB,UAAM,GAAG,MAAM;AAEf,UAAM,wBAAwB,KAAK,SAAS,IAAI,OAAO,gBAAgB,OAAO,UAAU,MAAM;AAE9F,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO,EAAE,YAAY,SAAS,IAAI,cAAc,SAAS,gBAAgB,KAAK;AAAA,EAChF;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,MAAM,qBAAqB,IAAI,OAAO,UAAU;AAAA,EACzD;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO,UAAU;AACjE,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB;AAAA,MACpB,kBAAkB,UAAU,UAAU,cAAc;AAAA,MACpD,UAAU,UAAU,SAAS,YAAY;AAAA,MACzC,gBAAgB,UAAU,SAAS,kBAAkB;AAAA,MACrD,eAAe,YAAY;AAAA,MAC3B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,YAAY;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,aAAa,UAAU,cAAc;AAC3C,QAAI,CAAC,WAAY;AACjB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,WAAW,CAAC;AAC/E,QAAI,UAAU;AACZ,SAAG,OAAO,QAAQ;AAClB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,QAAQ,oBAAsC,QAAQ;AAC5D,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2DAA2D,CAAC;AAAA,IACpG;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,MAAM,SAAS,YAAY,oBAAoB;AAC1F,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,MAAM,SAAS,GAAG,CAAC;AACpF,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,MAAM,SAAS;AAAA,QACnB,gBAAgB,MAAM,SAAS;AAAA,QAC/B,UAAU,MAAM,SAAS;AAAA,QACzB;AAAA,QACA,cAAc,MAAM,SAAS;AAAA,QAC7B,SAAS,MAAM,SAAS;AAAA,QACxB,MAAM,MAAM,SAAS;AAAA,QACrB,YAAY,MAAM,SAAS;AAAA,QAC3B,cAAc,MAAM,SAAS;AAAA,QAC7B,gBAAgB,MAAM,SAAS;AAAA,QAC/B,iBAAiB,MAAM,SAAS;AAAA,QAChC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,MAAM,SAAS;AACvC,eAAS,UAAU,MAAM,SAAS;AAClC,eAAS,OAAO,MAAM,SAAS;AAC/B,eAAS,aAAa,MAAM,SAAS;AACrC,eAAS,eAAe,MAAM,SAAS;AACvC,eAAS,iBAAiB,MAAM,SAAS;AACzC,eAAS,kBAAkB,MAAM,SAAS;AAAA,IAC5C;AACA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,MAAM,QAAQ,MAAS;AACpE,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,YAAY,SAAS,IAAI,cAAc,SAAS,gBAAgB,KAAK;AAAA,EAChF;AACF;AAEA,MAAM,wBAAsG;AAAA,EAC1G,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,sCAAsC,MAAM,QAAQ;AACnE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACzD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,uCAAuC,QAAQ;AAChG,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,GAAG,CAAC;AAC9E,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAC3E,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AAEpD,QAAI,OAAO,aAAa,QAAW;AACjC,YAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,UAAU,oBAAoB;AAChF,wBAAkB,KAAK,SAAS,QAAQ;AACxC,8BAAwB,KAAK,SAAS,cAAc;AACpD,eAAS,WAAW;AAAA,IACtB;AACA,QAAI,OAAO,iBAAiB,OAAW,UAAS,eAAe,OAAO;AACtE,QAAI,OAAO,YAAY,OAAW,UAAS,UAAU,OAAO,WAAW;AACvE,QAAI,OAAO,SAAS,OAAW,UAAS,OAAO,OAAO,QAAQ;AAC9D,QAAI,OAAO,eAAe,OAAW,UAAS,aAAa,OAAO,cAAc;AAChF,QAAI,OAAO,mBAAmB,OAAW,UAAS,iBAAiB,OAAO,kBAAkB;AAC5F,QAAI,OAAO,oBAAoB,OAAW,UAAS,kBAAkB,OAAO,mBAAmB;AAE/F,UAAM,GAAG,MAAM;AAEf,UAAM,wBAAwB,KAAK,SAAS,IAAI,SAAS,gBAAgB,SAAS,UAAU,MAAM;AAElG,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO,EAAE,YAAY,SAAS,GAAG;AAAA,EACnC;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,IAAI,MAAM;AACtC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,gBAAgB,MAAM,qBAAqB,IAAI,OAAO,SAAS,EAAE;AACvE,UAAM,UACJ,iBAAiB,cAAc,WAC3B;AAAA,MACE,OAAO;AAAA,MACP,cAAc;AAAA,MACd,CAAC,cAAc,gBAAgB,WAAW,QAAQ,cAAc,gBAAgB,kBAAkB,iBAAiB;AAAA,IACrH,IACA,CAAC;AACP,UAAM,gBAAgB,uBAAuB,OAAO,QAAQ,eAAe,MAAM;AACjF,QAAI,OAAO,KAAK,aAAa,EAAE,OAAQ,SAAQ,SAAS;AACxD,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO,SAAS;AAAA,MAC5B,oBAAoB;AAAA,MACpB,kBAAkB,OAAO,SAAS,cAAc;AAAA,MAChD,UAAU,OAAO,SAAS;AAAA,MAC1B,gBAAgB,OAAO,SAAS;AAAA,MAChC,gBAAgB;AAAA,MAChB,eAAe,iBAAiB;AAAA,MAChC;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,UACA,OAAO,iBAAiB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAwC,QAAQ;AAChE,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AACrF,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,SAAS,YAAY,oBAAoB;AAE3F,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,OAAO,SAAS;AAAA,QACpB,gBAAgB,OAAO,SAAS;AAAA,QAChC,UAAU,OAAO,SAAS;AAAA,QAC1B;AAAA,QACA,cAAc,OAAO,SAAS;AAAA,QAC9B,SAAS,OAAO,SAAS;AAAA,QACzB,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO,SAAS;AAAA,QAC5B,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,iBAAiB,OAAO,SAAS;AAAA,QACjC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,UAAU,OAAO,SAAS;AACnC,eAAS,OAAO,OAAO,SAAS;AAChC,eAAS,aAAa,OAAO,SAAS;AACtC,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,iBAAiB,OAAO,SAAS;AAC1C,eAAS,kBAAkB,OAAO,SAAS;AAAA,IAC7C;AAEA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,OAAO,QAAQ,SAAS,OAAO,MAAM;AAClF,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,MAAM,wBAAqI;AAAA,EACzI,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,sBAAsB;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,qBAAqB,IAAI,EAAE;AAClD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,sBAAsB;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,GAAG,CAAC;AACnE,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAC3E,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AACpD,OAAG,OAAO,QAAQ;AAClB,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,WAAO,EAAE,YAAY,SAAS,GAAG;AAAA,EACnC;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO,SAAS;AAAA,MAC5B,oBAAoB;AAAA,MACpB,kBAAkB,OAAO,SAAS,cAAc;AAAA,MAChD,UAAU,OAAO,SAAS;AAAA,MAC1B,gBAAgB,OAAO,SAAS;AAAA,MAChC,gBAAgB;AAAA,MAChB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAwC,QAAQ;AAChE,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,SAAS,YAAY,oBAAoB;AAC3F,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AACrF,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,OAAO,SAAS;AAAA,QACpB,gBAAgB,OAAO,SAAS;AAAA,QAChC,UAAU,OAAO,SAAS;AAAA,QAC1B;AAAA,QACA,cAAc,OAAO,SAAS;AAAA,QAC9B,SAAS,OAAO,SAAS;AAAA,QACzB,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO,SAAS;AAAA,QAC5B,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,iBAAiB,OAAO,SAAS;AAAA,QACjC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,UAAU,OAAO,SAAS;AACnC,eAAS,OAAO,OAAO,SAAS;AAChC,eAAS,aAAa,OAAO,SAAS;AACtC,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,iBAAiB,OAAO,SAAS;AAC1C,eAAS,kBAAkB,OAAO,SAAS;AAAA,IAC7C;AACA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,OAAO,QAAQ,MAAS;AACrE,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,gBAAgB,qBAAqB;AACrC,gBAAgB,qBAAqB;AACrC,gBAAgB,qBAAqB;",
+  "sourcesContent": ["import { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport {\n  loadCustomFieldSnapshot,\n  diffCustomFieldChanges,\n  buildCustomFieldResetMap,\n  type CustomFieldChangeSet,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'\nimport { ResourcesResourceActivity } from '../data/entities'\nimport {\n  resourcesResourceActivityCreateSchema,\n  resourcesResourceActivityUpdateSchema,\n  type ResourcesResourceActivityCreateInput,\n  type ResourcesResourceActivityUpdateInput,\n} from '../data/validators'\nimport { resourcesResourceActivityCrudEvents } from '../lib/crud'\nimport { ensureOrganizationScope, ensureTenantScope, extractUndoPayload, requireResource, resolveResourceAuthorUserId } from './shared'\nimport { E } from '#generated/entities.ids.generated'\n\nconst ACTIVITY_ENTITY_ID = E.resources.resources_resource_activity\nconst activityCrudIndexer: CrudIndexerConfig<ResourcesResourceActivity> = {\n  entityType: E.resources.resources_resource_activity,\n}\n\ntype ActivitySnapshot = {\n  activity: {\n    id: string\n    organizationId: string\n    tenantId: string\n    resourceId: string\n    activityType: string\n    subject: string | null\n    body: string | null\n    occurredAt: Date | null\n    authorUserId: string | null\n    appearanceIcon: string | null\n    appearanceColor: string | null\n  }\n  custom?: Record<string, unknown>\n}\n\ntype ActivityUndoPayload = {\n  before?: ActivitySnapshot | null\n  after?: ActivitySnapshot | null\n}\n\ntype ActivityChangeMap = Record<string, { from: unknown; to: unknown }> & {\n  custom?: CustomFieldChangeSet\n}\n\nasync function loadActivitySnapshot(em: EntityManager, id: string): Promise<ActivitySnapshot | null> {\n  const activity = await em.findOne(ResourcesResourceActivity, { id })\n  if (!activity) return null\n  const custom = await loadCustomFieldSnapshot(em, {\n    entityId: ACTIVITY_ENTITY_ID,\n    recordId: activity.id,\n    tenantId: activity.tenantId,\n    organizationId: activity.organizationId,\n  })\n  return {\n    activity: {\n      id: activity.id,\n      organizationId: activity.organizationId,\n      tenantId: activity.tenantId,\n      resourceId: typeof activity.resource === 'string' ? activity.resource : activity.resource.id,\n      activityType: activity.activityType,\n      subject: activity.subject ?? null,\n      body: activity.body ?? null,\n      occurredAt: activity.occurredAt ?? null,\n      authorUserId: activity.authorUserId ?? null,\n      appearanceIcon: activity.appearanceIcon ?? null,\n      appearanceColor: activity.appearanceColor ?? null,\n    },\n    custom,\n  }\n}\n\nasync function setActivityCustomFields(\n  ctx: CommandRuntimeContext,\n  activityId: string,\n  organizationId: string,\n  tenantId: string,\n  values: Record<string, unknown>,\n) {\n  if (!values || !Object.keys(values).length) return\n  const de = (ctx.container.resolve('dataEngine') as DataEngine)\n  await setCustomFieldsIfAny({\n    dataEngine: de,\n    entityId: ACTIVITY_ENTITY_ID,\n    recordId: activityId,\n    organizationId,\n    tenantId,\n    values,\n    notify: false,\n  })\n}\n\nconst createActivityCommand: CommandHandler<ResourcesResourceActivityCreateInput, { activityId: string; authorUserId: string | null }> = {\n  id: 'resources.resource-activities.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(resourcesResourceActivityCreateSchema, rawInput)\n    ensureTenantScope(ctx, parsed.tenantId)\n    ensureOrganizationScope(ctx, parsed.organizationId)\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, parsed.entityId, 'Resource not found')\n    ensureTenantScope(ctx, resource.tenantId)\n    ensureOrganizationScope(ctx, resource.organizationId)\n    const normalizedAuthor = await resolveResourceAuthorUserId(em, parsed.authorUserId, ctx, {\n      tenantId: resource.tenantId,\n      organizationId: resource.organizationId,\n    })\n\n    const activity = em.create(ResourcesResourceActivity, {\n      organizationId: parsed.organizationId,\n      tenantId: parsed.tenantId,\n      resource,\n      activityType: parsed.activityType,\n      subject: parsed.subject ?? null,\n      body: parsed.body ?? null,\n      occurredAt: parsed.occurredAt ?? null,\n      authorUserId: normalizedAuthor,\n      appearanceIcon: parsed.appearanceIcon ?? null,\n      appearanceColor: parsed.appearanceColor ?? null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    em.persist(activity)\n    await em.flush()\n\n    await setActivityCustomFields(ctx, activity.id, parsed.organizationId, parsed.tenantId, custom)\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    return { activityId: activity.id, authorUserId: activity.authorUserId ?? null }\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    return await loadActivitySnapshot(em, result.activityId)\n  },\n  buildLog: async ({ result, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const snapshot = await loadActivitySnapshot(em, result.activityId)\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.create', 'Create activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: result.activityId,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: snapshot?.activity?.resourceId ?? null,\n      tenantId: snapshot?.activity.tenantId ?? null,\n      organizationId: snapshot?.activity.organizationId ?? null,\n      snapshotAfter: snapshot ?? null,\n      payload: {\n        undo: {\n          after: snapshot ?? null,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const activityId = logEntry?.resourceId ?? null\n    if (!activityId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const existing = await em.findOne(ResourcesResourceActivity, { id: activityId })\n    if (existing) {\n      em.remove(existing)\n      await em.flush()\n    }\n  },\n  redo: async ({ logEntry, ctx }) => {\n    const after = resolveRedoSnapshot<ActivitySnapshot>(logEntry)\n    if (!after) {\n      throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for activity create' })\n    }\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, after.activity.resourceId, 'Resource not found')\n    let activity = await em.findOne(ResourcesResourceActivity, { id: after.activity.id })\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: after.activity.id,\n        organizationId: after.activity.organizationId,\n        tenantId: after.activity.tenantId,\n        resource,\n        activityType: after.activity.activityType,\n        subject: after.activity.subject,\n        body: after.activity.body,\n        occurredAt: after.activity.occurredAt,\n        authorUserId: after.activity.authorUserId,\n        appearanceIcon: after.activity.appearanceIcon,\n        appearanceColor: after.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = after.activity.activityType\n      activity.subject = after.activity.subject\n      activity.body = after.activity.body\n      activity.occurredAt = after.activity.occurredAt\n      activity.authorUserId = after.activity.authorUserId\n      activity.appearanceIcon = after.activity.appearanceIcon\n      activity.appearanceColor = after.activity.appearanceColor\n    }\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(after.custom, undefined)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n\n    return { activityId: activity.id, authorUserId: activity.authorUserId ?? null }\n  },\n}\n\nconst updateActivityCommand: CommandHandler<ResourcesResourceActivityUpdateInput, { activityId: string }> = {\n  id: 'resources.resource-activities.update',\n  async prepare(rawInput, ctx) {\n    const parsed = resourcesResourceActivityUpdateSchema.parse(rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const snapshot = await loadActivitySnapshot(em, parsed.id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(resourcesResourceActivityUpdateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const activity = await em.findOne(ResourcesResourceActivity, { id: parsed.id })\n    if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })\n    ensureTenantScope(ctx, activity.tenantId)\n    ensureOrganizationScope(ctx, activity.organizationId)\n\n    if (parsed.entityId !== undefined) {\n      const resource = await requireResource(em, parsed.entityId, 'Resource not found')\n      ensureTenantScope(ctx, resource.tenantId)\n      ensureOrganizationScope(ctx, resource.organizationId)\n      activity.resource = resource\n    }\n    if (parsed.activityType !== undefined) activity.activityType = parsed.activityType\n    if (parsed.subject !== undefined) activity.subject = parsed.subject ?? null\n    if (parsed.body !== undefined) activity.body = parsed.body ?? null\n    if (parsed.occurredAt !== undefined) activity.occurredAt = parsed.occurredAt ?? null\n    if (parsed.appearanceIcon !== undefined) activity.appearanceIcon = parsed.appearanceIcon ?? null\n    if (parsed.appearanceColor !== undefined) activity.appearanceColor = parsed.appearanceColor ?? null\n\n    await em.flush()\n\n    await setActivityCustomFields(ctx, activity.id, activity.organizationId, activity.tenantId, custom)\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    return { activityId: activity.id }\n  },\n  buildLog: async ({ snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const before = snapshots.before as ActivitySnapshot | undefined\n    if (!before) return null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterSnapshot = await loadActivitySnapshot(em, before.activity.id)\n    const changes: ActivityChangeMap =\n      afterSnapshot && afterSnapshot.activity\n        ? buildChanges(\n            before.activity as Record<string, unknown>,\n            afterSnapshot.activity as Record<string, unknown>,\n            ['resourceId', 'activityType', 'subject', 'body', 'occurredAt', 'authorUserId', 'appearanceIcon', 'appearanceColor'],\n          )\n        : {}\n    const customChanges = diffCustomFieldChanges(before.custom, afterSnapshot?.custom)\n    if (Object.keys(customChanges).length) changes.custom = customChanges\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.update', 'Update activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: before.activity.id,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: before.activity.resourceId ?? null,\n      tenantId: before.activity.tenantId,\n      organizationId: before.activity.organizationId,\n      snapshotBefore: before,\n      snapshotAfter: afterSnapshot ?? null,\n      changes,\n      payload: {\n        undo: {\n          before,\n          after: afterSnapshot ?? null,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<ActivityUndoPayload>(logEntry, { datePaths: ['before.activity.occurredAt'] })\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    let activity = await em.findOne(ResourcesResourceActivity, { id: before.activity.id })\n    const resource = await requireResource(em, before.activity.resourceId, 'Resource not found')\n\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: before.activity.id,\n        organizationId: before.activity.organizationId,\n        tenantId: before.activity.tenantId,\n        resource,\n        activityType: before.activity.activityType,\n        subject: before.activity.subject,\n        body: before.activity.body,\n        occurredAt: before.activity.occurredAt,\n        authorUserId: before.activity.authorUserId,\n        appearanceIcon: before.activity.appearanceIcon,\n        appearanceColor: before.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = before.activity.activityType\n      activity.subject = before.activity.subject\n      activity.body = before.activity.body\n      activity.occurredAt = before.activity.occurredAt\n      activity.authorUserId = before.activity.authorUserId\n      activity.appearanceIcon = before.activity.appearanceIcon\n      activity.appearanceColor = before.activity.appearanceColor\n    }\n\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(before.custom, payload?.after?.custom)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n  },\n}\n\nconst deleteActivityCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, { activityId: string }> = {\n  id: 'resources.resource-activities.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'Activity id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const snapshot = await loadActivitySnapshot(em, id)\n    return snapshot ? { before: snapshot } : {}\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'Activity id required')\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const activity = await em.findOne(ResourcesResourceActivity, { id })\n    if (!activity) throw new CrudHttpError(404, { error: 'Activity not found' })\n    ensureTenantScope(ctx, activity.tenantId)\n    ensureOrganizationScope(ctx, activity.organizationId)\n    em.remove(activity)\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n    return { activityId: activity.id }\n  },\n  buildLog: async ({ snapshots }) => {\n    const before = snapshots.before as ActivitySnapshot | undefined\n    if (!before) return null\n    const { translate } = await resolveTranslations()\n    return {\n      actionLabel: translate('resources.audit.resourceActivities.delete', 'Delete activity'),\n      resourceKind: 'resources.resource_activity',\n      resourceId: before.activity.id,\n      parentResourceKind: 'resources.resource',\n      parentResourceId: before.activity.resourceId ?? null,\n      tenantId: before.activity.tenantId,\n      organizationId: before.activity.organizationId,\n      snapshotBefore: before,\n      payload: {\n        undo: {\n          before,\n        } satisfies ActivityUndoPayload,\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<ActivityUndoPayload>(logEntry, { datePaths: ['before.activity.occurredAt'] })\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const resource = await requireResource(em, before.activity.resourceId, 'Resource not found')\n    let activity = await em.findOne(ResourcesResourceActivity, { id: before.activity.id })\n    if (!activity) {\n      activity = em.create(ResourcesResourceActivity, {\n        id: before.activity.id,\n        organizationId: before.activity.organizationId,\n        tenantId: before.activity.tenantId,\n        resource,\n        activityType: before.activity.activityType,\n        subject: before.activity.subject,\n        body: before.activity.body,\n        occurredAt: before.activity.occurredAt,\n        authorUserId: before.activity.authorUserId,\n        appearanceIcon: before.activity.appearanceIcon,\n        appearanceColor: before.activity.appearanceColor,\n        createdAt: new Date(),\n        updatedAt: new Date(),\n      })\n      em.persist(activity)\n    } else {\n      activity.resource = resource\n      activity.activityType = before.activity.activityType\n      activity.subject = before.activity.subject\n      activity.body = before.activity.body\n      activity.occurredAt = before.activity.occurredAt\n      activity.authorUserId = before.activity.authorUserId\n      activity.appearanceIcon = before.activity.appearanceIcon\n      activity.appearanceColor = before.activity.appearanceColor\n    }\n    await em.flush()\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: activity,\n      identifiers: {\n        id: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n      },\n      events: resourcesResourceActivityCrudEvents,\n      indexer: activityCrudIndexer,\n    })\n\n    const resetValues = buildCustomFieldResetMap(before.custom, undefined)\n    if (Object.keys(resetValues).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: ACTIVITY_ENTITY_ID,\n        recordId: activity.id,\n        organizationId: activity.organizationId,\n        tenantId: activity.tenantId,\n        values: resetValues,\n        notify: false,\n      })\n    }\n  },\n}\n\nregisterCommand(createActivityCommand)\nregisterCommand(updateActivityCommand)\nregisterCommand(deleteActivityCommand)\n"],
+  "mappings": "AAAA,SAAS,uBAAuB;AAEhC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,2CAA2C;AACpD,SAAS,yBAAyB,mBAAmB,oBAAoB,iBAAiB,mCAAmC;AAC7H,SAAS,SAAS;AAElB,MAAM,qBAAqB,EAAE,UAAU;AACvC,MAAM,sBAAoE;AAAA,EACxE,YAAY,EAAE,UAAU;AAC1B;AA4BA,eAAe,qBAAqB,IAAmB,IAA8C;AACnG,QAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,GAAG,CAAC;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,SAAS,MAAM,wBAAwB,IAAI;AAAA,IAC/C,UAAU;AAAA,IACV,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,EAC3B,CAAC;AACD,SAAO;AAAA,IACL,UAAU;AAAA,MACR,IAAI,SAAS;AAAA,MACb,gBAAgB,SAAS;AAAA,MACzB,UAAU,SAAS;AAAA,MACnB,YAAY,OAAO,SAAS,aAAa,WAAW,SAAS,WAAW,SAAS,SAAS;AAAA,MAC1F,cAAc,SAAS;AAAA,MACvB,SAAS,SAAS,WAAW;AAAA,MAC7B,MAAM,SAAS,QAAQ;AAAA,MACvB,YAAY,SAAS,cAAc;AAAA,MACnC,cAAc,SAAS,gBAAgB;AAAA,MACvC,gBAAgB,SAAS,kBAAkB;AAAA,MAC3C,iBAAiB,SAAS,mBAAmB;AAAA,IAC/C;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBACb,KACA,YACA,gBACA,UACA,QACA;AACA,MAAI,CAAC,UAAU,CAAC,OAAO,KAAK,MAAM,EAAE,OAAQ;AAC5C,QAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAM,qBAAqB;AAAA,IACzB,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,MAAM,wBAAmI;AAAA,EACvI,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,uCAAuC,QAAQ;AAChG,sBAAkB,KAAK,OAAO,QAAQ;AACtC,4BAAwB,KAAK,OAAO,cAAc;AAElD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,UAAU,oBAAoB;AAChF,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AACpD,UAAM,mBAAmB,MAAM,4BAA4B,IAAI,OAAO,cAAc,KAAK;AAAA,MACvF,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAED,UAAM,WAAW,GAAG,OAAO,2BAA2B;AAAA,MACpD,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB;AAAA,MACA,cAAc,OAAO;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,MAAM,OAAO,QAAQ;AAAA,MACrB,YAAY,OAAO,cAAc;AAAA,MACjC,cAAc;AAAA,MACd,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,QAAQ;AACnB,UAAM,GAAG,MAAM;AAEf,UAAM,wBAAwB,KAAK,SAAS,IAAI,OAAO,gBAAgB,OAAO,UAAU,MAAM;AAE9F,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO,EAAE,YAAY,SAAS,IAAI,cAAc,SAAS,gBAAgB,KAAK;AAAA,EAChF;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,WAAO,MAAM,qBAAqB,IAAI,OAAO,UAAU;AAAA,EACzD;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO,UAAU;AACjE,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,oBAAoB;AAAA,MACpB,kBAAkB,UAAU,UAAU,cAAc;AAAA,MACpD,UAAU,UAAU,SAAS,YAAY;AAAA,MACzC,gBAAgB,UAAU,SAAS,kBAAkB;AAAA,MACrD,eAAe,YAAY;AAAA,MAC3B,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,YAAY;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,aAAa,UAAU,cAAc;AAC3C,QAAI,CAAC,WAAY;AACjB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,WAAW,CAAC;AAC/E,QAAI,UAAU;AACZ,SAAG,OAAO,QAAQ;AAClB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,QAAQ,oBAAsC,QAAQ;AAC5D,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2DAA2D,CAAC;AAAA,IACpG;AACA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,MAAM,SAAS,YAAY,oBAAoB;AAC1F,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,MAAM,SAAS,GAAG,CAAC;AACpF,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,MAAM,SAAS;AAAA,QACnB,gBAAgB,MAAM,SAAS;AAAA,QAC/B,UAAU,MAAM,SAAS;AAAA,QACzB;AAAA,QACA,cAAc,MAAM,SAAS;AAAA,QAC7B,SAAS,MAAM,SAAS;AAAA,QACxB,MAAM,MAAM,SAAS;AAAA,QACrB,YAAY,MAAM,SAAS;AAAA,QAC3B,cAAc,MAAM,SAAS;AAAA,QAC7B,gBAAgB,MAAM,SAAS;AAAA,QAC/B,iBAAiB,MAAM,SAAS;AAAA,QAChC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,MAAM,SAAS;AACvC,eAAS,UAAU,MAAM,SAAS;AAClC,eAAS,OAAO,MAAM,SAAS;AAC/B,eAAS,aAAa,MAAM,SAAS;AACrC,eAAS,eAAe,MAAM,SAAS;AACvC,eAAS,iBAAiB,MAAM,SAAS;AACzC,eAAS,kBAAkB,MAAM,SAAS;AAAA,IAC5C;AACA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,MAAM,QAAQ,MAAS;AACpE,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,YAAY,SAAS,IAAI,cAAc,SAAS,gBAAgB,KAAK;AAAA,EAChF;AACF;AAEA,MAAM,wBAAsG;AAAA,EAC1G,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,SAAS,sCAAsC,MAAM,QAAQ;AACnE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACzD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,uCAAuC,QAAQ;AAChG,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,GAAG,CAAC;AAC9E,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAC3E,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AAEpD,QAAI,OAAO,aAAa,QAAW;AACjC,YAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,UAAU,oBAAoB;AAChF,wBAAkB,KAAK,SAAS,QAAQ;AACxC,8BAAwB,KAAK,SAAS,cAAc;AACpD,eAAS,WAAW;AAAA,IACtB;AACA,QAAI,OAAO,iBAAiB,OAAW,UAAS,eAAe,OAAO;AACtE,QAAI,OAAO,YAAY,OAAW,UAAS,UAAU,OAAO,WAAW;AACvE,QAAI,OAAO,SAAS,OAAW,UAAS,OAAO,OAAO,QAAQ;AAC9D,QAAI,OAAO,eAAe,OAAW,UAAS,aAAa,OAAO,cAAc;AAChF,QAAI,OAAO,mBAAmB,OAAW,UAAS,iBAAiB,OAAO,kBAAkB;AAC5F,QAAI,OAAO,oBAAoB,OAAW,UAAS,kBAAkB,OAAO,mBAAmB;AAE/F,UAAM,GAAG,MAAM;AAEf,UAAM,wBAAwB,KAAK,SAAS,IAAI,SAAS,gBAAgB,SAAS,UAAU,MAAM;AAElG,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,WAAO,EAAE,YAAY,SAAS,GAAG;AAAA,EACnC;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,IAAI,MAAM;AACtC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,gBAAgB,MAAM,qBAAqB,IAAI,OAAO,SAAS,EAAE;AACvE,UAAM,UACJ,iBAAiB,cAAc,WAC3B;AAAA,MACE,OAAO;AAAA,MACP,cAAc;AAAA,MACd,CAAC,cAAc,gBAAgB,WAAW,QAAQ,cAAc,gBAAgB,kBAAkB,iBAAiB;AAAA,IACrH,IACA,CAAC;AACP,UAAM,gBAAgB,uBAAuB,OAAO,QAAQ,eAAe,MAAM;AACjF,QAAI,OAAO,KAAK,aAAa,EAAE,OAAQ,SAAQ,SAAS;AACxD,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO,SAAS;AAAA,MAC5B,oBAAoB;AAAA,MACpB,kBAAkB,OAAO,SAAS,cAAc;AAAA,MAChD,UAAU,OAAO,SAAS;AAAA,MAC1B,gBAAgB,OAAO,SAAS;AAAA,MAChC,gBAAgB;AAAA,MAChB,eAAe,iBAAiB;AAAA,MAChC;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,UACA,OAAO,iBAAiB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAwC,UAAU,EAAE,WAAW,CAAC,4BAA4B,EAAE,CAAC;AAC/G,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AACrF,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,SAAS,YAAY,oBAAoB;AAE3F,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,OAAO,SAAS;AAAA,QACpB,gBAAgB,OAAO,SAAS;AAAA,QAChC,UAAU,OAAO,SAAS;AAAA,QAC1B;AAAA,QACA,cAAc,OAAO,SAAS;AAAA,QAC9B,SAAS,OAAO,SAAS;AAAA,QACzB,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO,SAAS;AAAA,QAC5B,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,iBAAiB,OAAO,SAAS;AAAA,QACjC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,UAAU,OAAO,SAAS;AACnC,eAAS,OAAO,OAAO,SAAS;AAChC,eAAS,aAAa,OAAO,SAAS;AACtC,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,iBAAiB,OAAO,SAAS;AAC1C,eAAS,kBAAkB,OAAO,SAAS;AAAA,IAC7C;AAEA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,OAAO,QAAQ,SAAS,OAAO,MAAM;AAClF,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,MAAM,wBAAqI;AAAA,EACzI,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,sBAAsB;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,qBAAqB,IAAI,EAAE;AAClD,WAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC5C;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,sBAAsB;AAClD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,GAAG,CAAC;AACnE,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAC3E,sBAAkB,KAAK,SAAS,QAAQ;AACxC,4BAAwB,KAAK,SAAS,cAAc;AACpD,OAAG,OAAO,QAAQ;AAClB,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,WAAO,EAAE,YAAY,SAAS,GAAG;AAAA,EACnC;AAAA,EACA,UAAU,OAAO,EAAE,UAAU,MAAM;AACjC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO;AAAA,MACL,aAAa,UAAU,6CAA6C,iBAAiB;AAAA,MACrF,cAAc;AAAA,MACd,YAAY,OAAO,SAAS;AAAA,MAC5B,oBAAoB;AAAA,MACpB,kBAAkB,OAAO,SAAS,cAAc;AAAA,MAChD,UAAU,OAAO,SAAS;AAAA,MAC1B,gBAAgB,OAAO,SAAS;AAAA,MAChC,gBAAgB;AAAA,MAChB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAwC,UAAU,EAAE,WAAW,CAAC,4BAA4B,EAAE,CAAC;AAC/G,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,WAAW,MAAM,gBAAgB,IAAI,OAAO,SAAS,YAAY,oBAAoB;AAC3F,QAAI,WAAW,MAAM,GAAG,QAAQ,2BAA2B,EAAE,IAAI,OAAO,SAAS,GAAG,CAAC;AACrF,QAAI,CAAC,UAAU;AACb,iBAAW,GAAG,OAAO,2BAA2B;AAAA,QAC9C,IAAI,OAAO,SAAS;AAAA,QACpB,gBAAgB,OAAO,SAAS;AAAA,QAChC,UAAU,OAAO,SAAS;AAAA,QAC1B;AAAA,QACA,cAAc,OAAO,SAAS;AAAA,QAC9B,SAAS,OAAO,SAAS;AAAA,QACzB,MAAM,OAAO,SAAS;AAAA,QACtB,YAAY,OAAO,SAAS;AAAA,QAC5B,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,iBAAiB,OAAO,SAAS;AAAA,QACjC,WAAW,oBAAI,KAAK;AAAA,QACpB,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,SAAG,QAAQ,QAAQ;AAAA,IACrB,OAAO;AACL,eAAS,WAAW;AACpB,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,UAAU,OAAO,SAAS;AACnC,eAAS,OAAO,OAAO,SAAS;AAChC,eAAS,aAAa,OAAO,SAAS;AACtC,eAAS,eAAe,OAAO,SAAS;AACxC,eAAS,iBAAiB,OAAO,SAAS;AAC1C,eAAS,kBAAkB,OAAO,SAAS;AAAA,IAC7C;AACA,UAAM,GAAG,MAAM;AAEf,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,SAAS;AAAA,QACb,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,MACrB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,OAAO,QAAQ,MAAS;AACrE,QAAI,OAAO,KAAK,WAAW,EAAE,QAAQ;AACnC,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,UAAU,SAAS;AAAA,QACnB,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,gBAAgB,qBAAqB;AACrC,gBAAgB,qBAAqB;AACrC,gBAAgB,qBAAqB;",
   "names": []
 }

package/dist/modules/sales/api/document-history/route.js

@@ -3,7 +3,10 @@ import { loadAuditLogDisplayMaps } from "@open-mercato/core/modules/audit_logs/a
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
-import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
+import {
+  resolveOrganizationScopeFilter,
+  resolveSingleOrganizationIdOrDeny
+} from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { NextResponse } from "next/server";
@@ -48,6 +51,7 @@ async function GET(req) {
       throw new CrudHttpError(401, { error: translate("sales.documents.errors.unauthorized", "Unauthorized") });
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    resolveSingleOrganizationIdOrDeny(scope, auth);
     const orgFilter = resolveOrganizationScopeFilter(scope, auth);
     const organizationId = orgFilter.rbacOrganizationId;
     const requiredFeature = query.kind === "order" ? "sales.orders.view" : "sales.quotes.view";

package/dist/modules/sales/api/document-history/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/api/document-history/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '@open-mercato/core/modules/audit_logs/api/audit-logs/display'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildHistoryEntries } from '../../lib/historyHelpers'\nimport { SalesNote } from '../../data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\n// Spec: SPEC-006-2026-01-23-order-status-history\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst querySchema = z.object({\n  kind: z.enum(['order', 'quote']),\n  id: z.string().uuid(),\n  limit: z.coerce.number().min(1).max(100).default(50),\n  before: z.string().optional(),\n  after: z.string().optional(),\n  types: z.string().optional(), // comma-separated: status,action,comment\n})\n\nexport type DocumentHistoryEntryKind = 'status' | 'action' | 'comment'\n\nconst HISTORY_TYPES: ReadonlySet<DocumentHistoryEntryKind> = new Set(['status', 'action', 'comment'])\n\nexport function parseDocumentHistoryTypes(input: string | null | undefined): Set<DocumentHistoryEntryKind> {\n  const raw = typeof input === 'string' ? input.trim() : ''\n  if (!raw) return new Set()\n  const values = raw\n    .split(',')\n    .map((part) => part.trim().toLowerCase())\n    .filter((value) => value.length > 0)\n  const result = new Set<DocumentHistoryEntryKind>()\n  values.forEach((value) => {\n    if (HISTORY_TYPES.has(value as DocumentHistoryEntryKind)) {\n      result.add(value as DocumentHistoryEntryKind)\n    }\n  })\n  return result\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    // Resolve the organization scope the same way every other scoped read does.\n    // Under \"All organizations\" (super-admin) `rbacOrganizationId` is null and\n    // `where` is empty, so the read scopes by tenant + resource only instead of\n    // failing \u2014 the document's `id` is a tenant-unique UUID, so no cross-org leak.\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n    const organizationId = orgFilter.rbacOrganizationId\n\n    const requiredFeature = query.kind === 'order' ? 'sales.orders.view' : 'sales.quotes.view'\n    const rbac = container.resolve('rbacService') as RbacService\n    const hasAccess = await rbac.userHasAllFeatures(auth.sub, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasAccess) {\n      throw new CrudHttpError(403, { error: translate('api.errors.forbidden', 'Forbidden') })\n    }\n\n    const resourceKind = query.kind === 'order' ? 'sales.order' : 'sales.quote'\n\n    const actionLogService = container.resolve('actionLogService') as ActionLogService\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const [actionLogList, notes] = await Promise.all([\n      actionLogService.list({\n        tenantId: auth.tenantId,\n        organizationId: organizationId ?? undefined,\n        resourceKind,\n        resourceId: query.id,\n        includeRelated: true,\n        limit: query.limit,\n        before: query.before ? new Date(query.before) : undefined,\n        after: query.after ? new Date(query.after) : undefined,\n      }),\n      findWithDecryption(\n        em,\n        SalesNote,\n        {\n          contextType: query.kind,\n          contextId: query.id,\n          tenantId: auth.tenantId,\n          ...orgFilter.where,\n          deletedAt: null,\n        },\n        { orderBy: { createdAt: 'DESC' } },\n        { tenantId: auth.tenantId, organizationId: organizationId ?? undefined },\n      ),\n    ])\n    const logs = actionLogList.items as ActionLog[]\n\n    const allUserIds = [\n      ...logs.map((l) => l.actorUserId).filter((v): v is string => !!v),\n      ...notes.map((n) => n.authorUserId).filter((v): v is string => !!v),\n    ]\n\n    const displayMaps = await loadAuditLogDisplayMaps(em, {\n      userIds: allUserIds,\n      tenantIds: [],\n      organizationIds: [],\n    })\n\n    let items = buildHistoryEntries({ actionLogs: logs, notes, kind: query.kind, displayUsers: displayMaps.users })\n    const typesFilter = parseDocumentHistoryTypes(query.types)\n    if (typesFilter.size > 0) {\n      items = items.filter((entry) => typesFilter.has(entry.kind as DocumentHistoryEntryKind))\n    }\n\n    let nextCursor: string | undefined = undefined\n    if (logs.length === query.limit && items.length > 0) {\n      const last = items[items.length - 1]\n      nextCursor = Buffer.from(`${last.occurredAt}|${last.id}`).toString('base64')\n    }\n\n    return NextResponse.json({ items, nextCursor })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('sales.document-history.get failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('sales.documents.history.error', 'Failed to load history.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst historyActorSchema = z.object({\n  id: z.string().uuid().nullable(),\n  label: z.string(),\n})\n\nconst historyEntrySchema = z.object({\n  id: z.string(),\n  occurredAt: z.string().datetime(),\n  kind: z.enum(['status', 'action', 'comment']),\n  action: z.string(),\n  actor: historyActorSchema,\n  source: z.enum(['action_log', 'note']),\n  metadata: z.object({\n    statusFrom: z.string().nullable().optional(),\n    statusTo: z.string().nullable().optional(),\n    documentKind: z.enum(['order', 'quote']).optional(),\n    commandId: z.string().optional(),\n    changedFields: z.array(z.string()).optional(),\n  }).optional(),\n})\n\nconst documentHistoryResponseSchema = z.object({\n  items: z.array(historyEntrySchema),\n  nextCursor: z.string().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Get document change history',\n  methods: {\n    GET: {\n      summary: 'List history entries for an order or quote',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'History entries', schema: documentHistoryResponseSchema },\n        { status: 400, description: 'Invalid query', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Document not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oBAAoB;AAK7B,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAI5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAID,MAAM,gBAAuD,oBAAI,IAAI,CAAC,UAAU,UAAU,SAAS,CAAC;AAE7F,SAAS,0BAA0B,OAAiE;AACzG,QAAM,MAAM,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,oBAAI,IAAI;AACzB,QAAM,SAAS,IACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,CAAC,EACvC,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAM,SAAS,oBAAI,IAA8B;AACjD,SAAO,QAAQ,CAAC,UAAU;AACxB,QAAI,cAAc,IAAI,KAAiC,GAAG;AACxD,aAAO,IAAI,KAAiC;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAEpE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAKxF,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,UAAM,iBAAiB,UAAU;AAEjC,UAAM,kBAAkB,MAAM,SAAS,UAAU,sBAAsB;AACvE,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,YAAY,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG;AAAA,MAC3E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,CAAC;AAAA,IACxF;AAEA,UAAM,eAAe,MAAM,SAAS,UAAU,gBAAgB;AAE9D,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/C,iBAAiB,KAAK;AAAA,QACpB,UAAU,KAAK;AAAA,QACf,gBAAgB,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,gBAAgB;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAAA,QAChD,OAAO,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,GAAG,UAAU;AAAA,UACb,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,QACjC,EAAE,UAAU,KAAK,UAAU,gBAAgB,kBAAkB,OAAU;AAAA,MACzE;AAAA,IACF,CAAC;AACD,UAAM,OAAO,cAAc;AAE3B,UAAM,aAAa;AAAA,MACjB,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,MAChE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,UAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,MACpD,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,MACZ,iBAAiB,CAAC;AAAA,IACpB,CAAC;AAED,QAAI,QAAQ,oBAAoB,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,cAAc,YAAY,MAAM,CAAC;AAC9G,UAAM,cAAc,0BAA0B,MAAM,KAAK;AACzD,QAAI,YAAY,OAAO,GAAG;AACxB,cAAQ,MAAM,OAAO,CAAC,UAAU,YAAY,IAAI,MAAM,IAAgC,CAAC;AAAA,IACzF;AAEA,QAAI,aAAiC;AACrC,QAAI,KAAK,WAAW,MAAM,SAAS,MAAM,SAAS,GAAG;AACnD,YAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,mBAAa,OAAO,KAAK,GAAG,KAAK,UAAU,IAAI,KAAK,EAAE,EAAE,EAAE,SAAS,QAAQ;AAAA,IAC7E;AAEA,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,EAChD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE;AAAA,MAC/E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO;AAAA,EACP,QAAQ,EAAE,KAAK,CAAC,cAAc,MAAM,CAAC;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACzC,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,IAClD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC9C,CAAC,EAAE,SAAS;AACd,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,8BAA8B;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport { loadAuditLogDisplayMaps } from '@open-mercato/core/modules/audit_logs/api/audit-logs/display'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  resolveOrganizationScopeFilter,\n  resolveSingleOrganizationIdOrDeny,\n} from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildHistoryEntries } from '../../lib/historyHelpers'\nimport { SalesNote } from '../../data/entities'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\n// Spec: SPEC-006-2026-01-23-order-status-history\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst querySchema = z.object({\n  kind: z.enum(['order', 'quote']),\n  id: z.string().uuid(),\n  limit: z.coerce.number().min(1).max(100).default(50),\n  before: z.string().optional(),\n  after: z.string().optional(),\n  types: z.string().optional(), // comma-separated: status,action,comment\n})\n\nexport type DocumentHistoryEntryKind = 'status' | 'action' | 'comment'\n\nconst HISTORY_TYPES: ReadonlySet<DocumentHistoryEntryKind> = new Set(['status', 'action', 'comment'])\n\nexport function parseDocumentHistoryTypes(input: string | null | undefined): Set<DocumentHistoryEntryKind> {\n  const raw = typeof input === 'string' ? input.trim() : ''\n  if (!raw) return new Set()\n  const values = raw\n    .split(',')\n    .map((part) => part.trim().toLowerCase())\n    .filter((value) => value.length > 0)\n  const result = new Set<DocumentHistoryEntryKind>()\n  values.forEach((value) => {\n    if (HISTORY_TYPES.has(value as DocumentHistoryEntryKind)) {\n      result.add(value as DocumentHistoryEntryKind)\n    }\n  })\n  return result\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    resolveSingleOrganizationIdOrDeny(scope, auth)\n    // Resolve the organization scope the same way every other scoped read does.\n    // Under \"All organizations\" (super-admin) `rbacOrganizationId` is null and\n    // `where` is empty, so the read scopes by tenant + resource only instead of\n    // failing \u2014 the document's `id` is a tenant-unique UUID, so no cross-org leak.\n    const orgFilter = resolveOrganizationScopeFilter(scope, auth)\n    const organizationId = orgFilter.rbacOrganizationId\n\n    const requiredFeature = query.kind === 'order' ? 'sales.orders.view' : 'sales.quotes.view'\n    const rbac = container.resolve('rbacService') as RbacService\n    const hasAccess = await rbac.userHasAllFeatures(auth.sub, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasAccess) {\n      throw new CrudHttpError(403, { error: translate('api.errors.forbidden', 'Forbidden') })\n    }\n\n    const resourceKind = query.kind === 'order' ? 'sales.order' : 'sales.quote'\n\n    const actionLogService = container.resolve('actionLogService') as ActionLogService\n    const em = (container.resolve('em') as EntityManager).fork()\n\n    const [actionLogList, notes] = await Promise.all([\n      actionLogService.list({\n        tenantId: auth.tenantId,\n        organizationId: organizationId ?? undefined,\n        resourceKind,\n        resourceId: query.id,\n        includeRelated: true,\n        limit: query.limit,\n        before: query.before ? new Date(query.before) : undefined,\n        after: query.after ? new Date(query.after) : undefined,\n      }),\n      findWithDecryption(\n        em,\n        SalesNote,\n        {\n          contextType: query.kind,\n          contextId: query.id,\n          tenantId: auth.tenantId,\n          ...orgFilter.where,\n          deletedAt: null,\n        },\n        { orderBy: { createdAt: 'DESC' } },\n        { tenantId: auth.tenantId, organizationId: organizationId ?? undefined },\n      ),\n    ])\n    const logs = actionLogList.items as ActionLog[]\n\n    const allUserIds = [\n      ...logs.map((l) => l.actorUserId).filter((v): v is string => !!v),\n      ...notes.map((n) => n.authorUserId).filter((v): v is string => !!v),\n    ]\n\n    const displayMaps = await loadAuditLogDisplayMaps(em, {\n      userIds: allUserIds,\n      tenantIds: [],\n      organizationIds: [],\n    })\n\n    let items = buildHistoryEntries({ actionLogs: logs, notes, kind: query.kind, displayUsers: displayMaps.users })\n    const typesFilter = parseDocumentHistoryTypes(query.types)\n    if (typesFilter.size > 0) {\n      items = items.filter((entry) => typesFilter.has(entry.kind as DocumentHistoryEntryKind))\n    }\n\n    let nextCursor: string | undefined = undefined\n    if (logs.length === query.limit && items.length > 0) {\n      const last = items[items.length - 1]\n      nextCursor = Buffer.from(`${last.occurredAt}|${last.id}`).toString('base64')\n    }\n\n    return NextResponse.json({ items, nextCursor })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('sales.document-history.get failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('sales.documents.history.error', 'Failed to load history.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst historyActorSchema = z.object({\n  id: z.string().uuid().nullable(),\n  label: z.string(),\n})\n\nconst historyEntrySchema = z.object({\n  id: z.string(),\n  occurredAt: z.string().datetime(),\n  kind: z.enum(['status', 'action', 'comment']),\n  action: z.string(),\n  actor: historyActorSchema,\n  source: z.enum(['action_log', 'note']),\n  metadata: z.object({\n    statusFrom: z.string().nullable().optional(),\n    statusTo: z.string().nullable().optional(),\n    documentKind: z.enum(['order', 'quote']).optional(),\n    commandId: z.string().optional(),\n    changedFields: z.array(z.string()).optional(),\n  }).optional(),\n})\n\nconst documentHistoryResponseSchema = z.object({\n  items: z.array(historyEntrySchema),\n  nextCursor: z.string().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Get document change history',\n  methods: {\n    GET: {\n      summary: 'List history entries for an order or quote',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'History entries', schema: documentHistoryResponseSchema },\n        { status: 400, description: 'Invalid query', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Document not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,oBAAoB;AAK7B,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAI5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC/B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA;AAC7B,CAAC;AAID,MAAM,gBAAuD,oBAAI,IAAI,CAAC,UAAU,UAAU,SAAS,CAAC;AAE7F,SAAS,0BAA0B,OAAiE;AACzG,QAAM,MAAM,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACvD,MAAI,CAAC,IAAK,QAAO,oBAAI,IAAI;AACzB,QAAM,SAAS,IACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,CAAC,EACvC,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAM,SAAS,oBAAI,IAA8B;AACjD,SAAO,QAAQ,CAAC,UAAU;AACxB,QAAI,cAAc,IAAI,KAAiC,GAAG;AACxD,aAAO,IAAI,KAAiC;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAEpE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,sCAAkC,OAAO,IAAI;AAK7C,UAAM,YAAY,+BAA+B,OAAO,IAAI;AAC5D,UAAM,iBAAiB,UAAU;AAEjC,UAAM,kBAAkB,MAAM,SAAS,UAAU,sBAAsB;AACvE,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,YAAY,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG;AAAA,MAC3E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,CAAC;AAAA,IACxF;AAEA,UAAM,eAAe,MAAM,SAAS,UAAU,gBAAgB;AAE9D,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE3D,UAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/C,iBAAiB,KAAK;AAAA,QACpB,UAAU,KAAK;AAAA,QACf,gBAAgB,kBAAkB;AAAA,QAClC;AAAA,QACA,YAAY,MAAM;AAAA,QAClB,gBAAgB;AAAA,QAChB,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAAA,QAChD,OAAO,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,GAAG,UAAU;AAAA,UACb,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,QACjC,EAAE,UAAU,KAAK,UAAU,gBAAgB,kBAAkB,OAAU;AAAA,MACzE;AAAA,IACF,CAAC;AACD,UAAM,OAAO,cAAc;AAE3B,UAAM,aAAa;AAAA,MACjB,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,MAChE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,UAAM,cAAc,MAAM,wBAAwB,IAAI;AAAA,MACpD,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,MACZ,iBAAiB,CAAC;AAAA,IACpB,CAAC;AAED,QAAI,QAAQ,oBAAoB,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,cAAc,YAAY,MAAM,CAAC;AAC9G,UAAM,cAAc,0BAA0B,MAAM,KAAK;AACzD,QAAI,YAAY,OAAO,GAAG;AACxB,cAAQ,MAAM,OAAO,CAAC,UAAU,YAAY,IAAI,MAAM,IAAgC,CAAC;AAAA,IACzF;AAEA,QAAI,aAAiC;AACrC,QAAI,KAAK,WAAW,MAAM,SAAS,MAAM,SAAS,GAAG;AACnD,YAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,mBAAa,OAAO,KAAK,GAAG,KAAK,UAAU,IAAI,KAAK,EAAE,EAAE,EAAE,SAAS,QAAQ;AAAA,IAC7E;AAEA,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,EAChD,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE;AAAA,MAC/E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,OAAO;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,KAAK,CAAC,UAAU,UAAU,SAAS,CAAC;AAAA,EAC5C,QAAQ,EAAE,OAAO;AAAA,EACjB,OAAO;AAAA,EACP,QAAQ,EAAE,KAAK,CAAC,cAAc,MAAM,CAAC;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACzC,cAAc,EAAE,KAAK,CAAC,SAAS,OAAO,CAAC,EAAE,SAAS;AAAA,IAClD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC9C,CAAC,EAAE,SAAS;AACd,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,kBAAkB;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,8BAA8B;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/document-numbers/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { documentNumberRequestSchema } from "../../data/validators.js";
@@ -20,7 +21,7 @@ async function resolveRequestContext(req) {
     throw new CrudHttpError(401, { error: translate("sales.documents.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate("sales.documents.errors.organization_required", "Organization context is required")

package/dist/modules/sales/api/document-numbers/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/api/document-numbers/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { documentNumberRequestSchema } from '../../data/validators'\nimport { withScopedPayload } from '../utils'\nimport { SalesDocumentNumberGenerator } from '../../services/salesDocumentNumberGenerator'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx, translate }\n}\n\nasync function ensureKindPermission(\n  ctx: CommandRuntimeContext,\n  kind: 'order' | 'quote' | 'invoice' | 'credit_memo',\n  translate: (key: string, fallback?: string) => string\n) {\n  const rbac = ctx.container.resolve('rbacService') as RbacService | null\n  const auth = ctx.auth\n  if (!rbac || !auth?.sub) return\n  const kindFeatureMap: Record<string, string> = {\n    order: 'sales.orders.manage',\n    quote: 'sales.quotes.manage',\n    invoice: 'sales.invoices.manage',\n    credit_memo: 'sales.credit_memos.manage',\n  }\n  const requiredFeatures = [\n    kindFeatureMap[kind] ?? 'sales.orders.manage',\n    'sales.documents.number.edit',\n  ]\n  const ok = await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,\n  })\n  if (!ok) {\n    throw new CrudHttpError(403, {\n      error: translate('sales.documents.errors.number_forbidden', 'You cannot generate document numbers.'),\n    })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await resolveRequestContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = documentNumberRequestSchema.parse(scoped)\n    await ensureKindPermission(ctx, input.kind, translate)\n\n    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator\n    const result = await generator.generate({\n      kind: input.kind,\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      format: input.format,\n    })\n\n    return NextResponse.json({\n      number: result.number,\n      format: result.format,\n      sequence: result.sequence,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.document-numbers.generate failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.documents.errors.number_generate_failed', 'Failed to generate document number.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Generate sales document number',\n  methods: {\n    POST: {\n      summary: 'Generate next number',\n      description: 'Generates the next sales order or quote number using configured formatting rules.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: documentNumberRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Generated number',\n          schema: z.object({\n            number: z.string(),\n            format: z.string(),\n            sequence: z.number(),\n          }),\n        },\n        { status: 400, description: 'Invalid input or scope missing', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAG/C,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAOA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAe,qBACb,KACA,MACA,WACA;AACA,QAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,MAAM,IAAK;AACzB,QAAM,iBAAyC;AAAA,IAC7C,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACA,QAAM,mBAAmB;AAAA,IACvB,eAAe,IAAI,KAAK;AAAA,IACxB;AAAA,EACF;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,IACnE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,IAAI,0BAA0B,KAAK,SAAS;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,2CAA2C,uCAAuC;AAAA,IACrG,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,sBAAsB,GAAG;AAC1D,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,4BAA4B,MAAM,MAAM;AACtD,UAAM,qBAAqB,KAAK,MAAM,MAAM,SAAS;AAErD,UAAM,YAAY,IAAI,UAAU,QAAQ,8BAA8B;AACtE,UAAM,SAAS,MAAM,UAAU,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iDAAiD,qCAAqC,EAAE;AAAA,MAC3G,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,QAAQ,EAAE,OAAO;AAAA,YACjB,QAAQ,EAAE,OAAO;AAAA,YACjB,UAAU,EAAE,OAAO;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { documentNumberRequestSchema } from '../../data/validators'\nimport { withScopedPayload } from '../utils'\nimport { SalesDocumentNumberGenerator } from '../../services/salesDocumentNumberGenerator'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n  translate: (key: string, fallback?: string) => string\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx, translate }\n}\n\nasync function ensureKindPermission(\n  ctx: CommandRuntimeContext,\n  kind: 'order' | 'quote' | 'invoice' | 'credit_memo',\n  translate: (key: string, fallback?: string) => string\n) {\n  const rbac = ctx.container.resolve('rbacService') as RbacService | null\n  const auth = ctx.auth\n  if (!rbac || !auth?.sub) return\n  const kindFeatureMap: Record<string, string> = {\n    order: 'sales.orders.manage',\n    quote: 'sales.quotes.manage',\n    invoice: 'sales.invoices.manage',\n    credit_memo: 'sales.credit_memos.manage',\n  }\n  const requiredFeatures = [\n    kindFeatureMap[kind] ?? 'sales.orders.manage',\n    'sales.documents.number.edit',\n  ]\n  const ok = await rbac.userHasAllFeatures(auth.sub, requiredFeatures, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: ctx.selectedOrganizationId ?? auth.orgId ?? null,\n  })\n  if (!ok) {\n    throw new CrudHttpError(403, {\n      error: translate('sales.documents.errors.number_forbidden', 'You cannot generate document numbers.'),\n    })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await resolveRequestContext(req)\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload, ctx, translate)\n    const input = documentNumberRequestSchema.parse(scoped)\n    await ensureKindPermission(ctx, input.kind, translate)\n\n    const generator = ctx.container.resolve('salesDocumentNumberGenerator') as SalesDocumentNumberGenerator\n    const result = await generator.generate({\n      kind: input.kind,\n      organizationId: input.organizationId,\n      tenantId: input.tenantId,\n      format: input.format,\n    })\n\n    return NextResponse.json({\n      number: result.number,\n      format: result.format,\n      sequence: result.sequence,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.document-numbers.generate failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.documents.errors.number_generate_failed', 'Failed to generate document number.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Generate sales document number',\n  methods: {\n    POST: {\n      summary: 'Generate next number',\n      description: 'Generates the next sales order or quote number using configured formatting rules.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: documentNumberRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Generated number',\n          schema: z.object({\n            number: z.string(),\n            format: z.string(),\n            sequence: z.number(),\n          }),\n        },\n        { status: 400, description: 'Invalid input or scope missing', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAG/C,SAAS,mCAAmC;AAC5C,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAOA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAe,qBACb,KACA,MACA,WACA;AACA,QAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,MAAM,IAAK;AACzB,QAAM,iBAAyC;AAAA,IAC7C,OAAO;AAAA,IACP,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACA,QAAM,mBAAmB;AAAA,IACvB,eAAe,IAAI,KAAK;AAAA,IACxB;AAAA,EACF;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,kBAAkB;AAAA,IACnE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,IAAI,0BAA0B,KAAK,SAAS;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,2CAA2C,uCAAuC;AAAA,IACrG,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,sBAAsB,GAAG;AAC1D,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,SAAS,KAAK,SAAS;AACxD,UAAM,QAAQ,4BAA4B,MAAM,MAAM;AACtD,UAAM,qBAAqB,KAAK,MAAM,MAAM,SAAS;AAErD,UAAM,YAAY,IAAI,UAAU,QAAQ,8BAA8B;AACtE,UAAM,SAAS,MAAM,UAAU,SAAS;AAAA,MACtC,MAAM,MAAM;AAAA,MACZ,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,iDAAiD,qCAAqC,EAAE;AAAA,MAC3G,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,QAAQ,EAAE,OAAO;AAAA,YACjB,QAAQ,EAAE,OAAO;AAAA,YACjB,UAAU,EAAE,OAAO;AAAA,UACrB,CAAC;AAAA,QACH;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/quotes/convert/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -53,7 +54,7 @@ async function resolveRequestContext(req) {
     throw new CrudHttpError(401, { error: translate("sales.documents.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate("sales.documents.errors.organization_required", "Organization context is required")

package/dist/modules/sales/api/quotes/convert/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/convert/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { withScopedPayload } from '../../utils'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('sales')\n\nconst convertSchema = z.object({\n  quoteId: z.string().uuid(),\n  orderId: z.string().uuid().optional(),\n  orderNumber: z.string().trim().max(191).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage', 'sales.orders.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = convertSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { quoteId: string; orderId?: string; orderNumber?: string },\n      { orderId: string }\n    >('sales.quotes.convert_to_order', { input, ctx })\n\n    const orderId = result?.orderId ?? input.orderId ?? input.quoteId\n    const jsonResponse = NextResponse.json({ orderId })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      jsonResponse.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'sales.order',\n          resourceId: logEntry.resourceId ?? orderId,\n          executedAt: logEntry.createdAt instanceof Date\n            ? logEntry.createdAt.toISOString()\n            : typeof logEntry.createdAt === 'string'\n              ? logEntry.createdAt\n              : new Date().toISOString(),\n        })\n      )\n    }\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return jsonResponse\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.convert failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.documents.detail.convertError', 'Failed to convert quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst convertResponseSchema = z.object({\n  orderId: z.string().uuid(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Convert quote to order',\n  methods: {\n    POST: {\n      summary: 'Convert quote',\n      description: 'Creates a sales order from a quote and removes the original quote record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: convertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Conversion succeeded', schema: convertResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,qBAAqB,EAAE;AAC7F;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,cAAc,MAAM,MAAM;AACxC,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AACA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,iCAAiC,EAAE,OAAO,IAAI,CAAC;AAEjD,UAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,MAAM;AAC1D,UAAM,eAAe,aAAa,KAAK,EAAE,QAAQ,CAAC;AAElD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,mBAAa,QAAQ;AAAA,QACnB;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OACtC,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,uCAAuC,0BAA0B,EAAE;AAAA,MACtF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { withScopedPayload } from '../../utils'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('sales')\n\nconst convertSchema = z.object({\n  quoteId: z.string().uuid(),\n  orderId: z.string().uuid().optional(),\n  orderNumber: z.string().trim().max(191).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage', 'sales.orders.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = convertSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<\n      { quoteId: string; orderId?: string; orderNumber?: string },\n      { orderId: string }\n    >('sales.quotes.convert_to_order', { input, ctx })\n\n    const orderId = result?.orderId ?? input.orderId ?? input.quoteId\n    const jsonResponse = NextResponse.json({ orderId })\n\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      jsonResponse.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'sales.order',\n          resourceId: logEntry.resourceId ?? orderId,\n          executedAt: logEntry.createdAt instanceof Date\n            ? logEntry.createdAt.toISOString()\n            : typeof logEntry.createdAt === 'string'\n              ? logEntry.createdAt\n              : new Date().toISOString(),\n        })\n      )\n    }\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return jsonResponse\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.convert failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.documents.detail.convertError', 'Failed to convert quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nconst convertResponseSchema = z.object({\n  orderId: z.string().uuid(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Convert quote to order',\n  methods: {\n    POST: {\n      summary: 'Convert quote',\n      description: 'Creates a sales order from a quote and removes the original quote record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: convertSchema,\n      },\n      responses: [\n        { status: 200, description: 'Conversion succeeded', schema: convertResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,eAAe,uBAAuB;AAE/C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAEnC,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,qBAAqB,EAAE;AAC7F;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,cAAc,MAAM,MAAM;AACxC,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AACA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,iCAAiC,EAAE,OAAO,IAAI,CAAC;AAEjD,UAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,MAAM;AAC1D,UAAM,eAAe,aAAa,KAAK,EAAE,QAAQ,CAAC;AAElD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,mBAAa,QAAQ;AAAA,QACnB;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc;AAAA,UACnC,YAAY,SAAS,qBAAqB,OACtC,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC/B,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,uCAAuC,0BAA0B,EAAE;AAAA,MACtF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sales/api/quotes/send/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations, detectLocale } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError, notFound } from "@open-mercato/shared/lib/crud/errors";
 import {
@@ -55,7 +56,7 @@ async function resolveRequestContext(req) {
     throw new CrudHttpError(401, { error: translate("sales.documents.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate("sales.documents.errors.organization_required", "Organization context is required")

package/dist/modules/sales/api/quotes/send/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/sales/api/quotes/send/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations, detectLocale } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport crypto from 'node:crypto'\nimport { withScopedPayload } from '../../utils'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { SalesQuote } from '../../../data/entities'\nimport { quoteSendSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteSentEmail } from '../../../emails/QuoteSentEmail'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nfunction resolveQuoteEmail(quote: SalesQuote): string | null {\n  const normalizeRecord = (value: unknown): Record<string, unknown> | null => {\n    if (value && typeof value === 'object' && !Array.isArray(value)) return value as Record<string, unknown>\n    if (typeof value !== 'string') return null\n    const parsed = parseDecryptedFieldValue(value)\n    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : null\n  }\n  const snapshot = normalizeRecord(quote.customerSnapshot)\n  const metadata = normalizeRecord(quote.metadata)\n  const contact = snapshot?.contact as Record<string, unknown> | undefined\n  const customer = snapshot?.customer as Record<string, unknown> | undefined\n  const candidate =\n    (typeof contact?.email === 'string' && contact.email.trim()) ||\n    (typeof customer?.primaryEmail === 'string' && customer.primaryEmail.trim()) ||\n    (typeof metadata?.customerEmail === 'string' && metadata.customerEmail.trim()) ||\n    null\n  if (!candidate) return null\n  const parsed = z.string().email().safeParse(candidate)\n  return parsed.success ? parsed.data : null\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = quoteSendSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const tenantScope = ctx.auth?.tenantId\n      ? { tenantId: ctx.auth.tenantId, organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null }\n      : undefined\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: input.quoteId, deletedAt: null }, {}, tenantScope)\n    if (!quote) {\n      throw notFound(translate('sales.documents.detail.error', 'Document not found or inaccessible.'))\n    }\n    if (quote.tenantId !== ctx.auth?.tenantId || quote.organizationId !== ctx.selectedOrganizationId) {\n      throw new CrudHttpError(403, { error: translate('sales.documents.errors.forbidden', 'Forbidden') })\n    }\n\n    if ((quote.status ?? null) === 'canceled') {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.canceled', 'Canceled quotes cannot be sent.') })\n    }\n\n    const email = resolveQuoteEmail(quote)\n    if (!email) {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.missingEmail', 'Customer email is required to send a quote.') })\n    }\n\n    const now = new Date()\n    const validUntil = new Date(now)\n    validUntil.setUTCDate(validUntil.getUTCDate() + input.validForDays)\n\n    const rawAcceptanceToken = crypto.randomUUID()\n\n    // Persist the send state (status/token/sentAt) atomically and commit it\n    // BEFORE the email goes out, so a customer never receives a link whose\n    // acceptance token was not durably stored.\n    await em.transactional(async (tx) => {\n      quote.validUntil = validUntil\n      quote.acceptanceToken = hashAuthToken(rawAcceptanceToken)\n      quote.sentAt = now\n      quote.status = 'sent'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(tx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'sent',\n      })\n      quote.updatedAt = now\n      tx.persist(quote)\n    })\n\n    const appUrl = process.env.APP_URL || ''\n    const url = appUrl ? `${appUrl.replace(/\\/$/, '')}/quote/${rawAcceptanceToken}` : `/quote/${rawAcceptanceToken}`\n\n    const locale = await detectLocale()\n    const validUntilFormatted = validUntil.toLocaleDateString(locale, {\n      year: 'numeric',\n      month: 'long',\n      day: 'numeric',\n    })\n\n    const copy = {\n      preview: translate('sales.quotes.email.preview', 'Quote {quoteNumber} is ready for review', { quoteNumber: quote.quoteNumber }),\n      heading: translate('sales.quotes.email.heading', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      total: translate('sales.quotes.email.total', 'Total: {amount} {currency}', {\n        amount: quote.grandTotalGrossAmount ?? quote.grandTotalNetAmount ?? '0',\n        currency: quote.currencyCode,\n      }),\n      validUntil: translate('sales.quotes.email.validUntil', 'Valid until: {date}', { date: validUntilFormatted }),\n      cta: translate('sales.quotes.email.cta', 'View quote'),\n      footer: translate('sales.quotes.email.footer', 'Open Mercato'),\n    }\n\n    // Side effect after commit: an email failure must not roll back the send state.\n    await sendEmail({\n      to: email,\n      subject: translate('sales.quotes.email.subject', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      react: QuoteSentEmail({ url, copy }),\n      tenantId: quote.tenantId,\n      organizationId: quote.organizationId,\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.send failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.quotes.send.failed', 'Failed to send quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Send quote to customer',\n  methods: {\n    POST: {\n      summary: 'Send quote',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteSendSchema,\n      },\n      responses: [\n        { status: 200, description: 'Email queued', schema: z.object({ ok: z.literal(true) }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,eAAe,iBAAiB,gBAAgB;AAEzD;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,OAAO,YAAY;AACnB,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,gCAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,QAAM,kBAAkB,CAAC,UAAmD;AAC1E,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAMA,UAAS,yBAAyB,KAAK;AAC7C,WAAOA,WAAU,OAAOA,YAAW,YAAY,CAAC,MAAM,QAAQA,OAAM,IAChEA,UACA;AAAA,EACN;AACA,QAAM,WAAW,gBAAgB,MAAM,gBAAgB;AACvD,QAAMC,YAAW,gBAAgB,MAAM,QAAQ;AAC/C,QAAM,UAAU,UAAU;AAC1B,QAAM,WAAW,UAAU;AAC3B,QAAM,YACH,OAAO,SAAS,UAAU,YAAY,QAAQ,MAAM,KAAK,KACzD,OAAO,UAAU,iBAAiB,YAAY,SAAS,aAAa,KAAK,KACzE,OAAOA,WAAU,kBAAkB,YAAYA,UAAS,cAAc,KAAK,KAC5E;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAS;AACrD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,cAAc,IAAI,MAAM,WAC1B,EAAE,UAAU,IAAI,KAAK,UAAU,gBAAgB,IAAI,0BAA0B,IAAI,KAAK,SAAS,KAAK,IACpG;AACJ,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,MAAM,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AACjH,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,UAAU,gCAAgC,qCAAqC,CAAC;AAAA,IACjG;AACA,QAAI,MAAM,aAAa,IAAI,MAAM,YAAY,MAAM,mBAAmB,IAAI,wBAAwB;AAChG,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,WAAW,EAAE,CAAC;AAAA,IACpG;AAEA,SAAK,MAAM,UAAU,UAAU,YAAY;AACzC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8BAA8B,iCAAiC,EAAE,CAAC;AAAA,IACpH;AAEA,UAAM,QAAQ,kBAAkB,KAAK;AACrC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,6CAA6C,EAAE,CAAC;AAAA,IACpI;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,aAAa,IAAI,KAAK,GAAG;AAC/B,eAAW,WAAW,WAAW,WAAW,IAAI,MAAM,YAAY;AAElE,UAAM,qBAAqB,OAAO,WAAW;AAK7C,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,aAAa;AACnB,YAAM,kBAAkB,cAAc,kBAAkB;AACxD,YAAM,SAAS;AACf,YAAM,SAAS;AACf,YAAM,gBAAgB,MAAM,4BAA4B,IAAI;AAAA,QAC1D,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,YAAY;AAClB,SAAG,QAAQ,KAAK;AAAA,IAClB,CAAC;AAED,UAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,UAAM,MAAM,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,UAAU,kBAAkB,KAAK,UAAU,kBAAkB;AAE9G,UAAM,SAAS,MAAM,aAAa;AAClC,UAAM,sBAAsB,WAAW,mBAAmB,QAAQ;AAAA,MAChE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAED,UAAM,OAAO;AAAA,MACX,SAAS,UAAU,8BAA8B,2CAA2C,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC9H,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,UAAU,4BAA4B,8BAA8B;AAAA,QACzE,QAAQ,MAAM,yBAAyB,MAAM,uBAAuB;AAAA,QACpE,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,MACD,YAAY,UAAU,iCAAiC,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3G,KAAK,UAAU,0BAA0B,YAAY;AAAA,MACrD,QAAQ,UAAU,6BAA6B,cAAc;AAAA,IAC/D;AAGA,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,4BAA4B,uBAAuB,EAAE;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations, detectLocale } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n  type MutationGuardInput,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport crypto from 'node:crypto'\nimport { withScopedPayload } from '../../utils'\nimport { hashAuthToken } from '../../../../auth/lib/tokenHash'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { SalesQuote } from '../../../data/entities'\nimport { quoteSendSchema } from '../../../data/validators'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { resolveStatusEntryIdByValue } from '../../../lib/statusHelpers'\nimport { QuoteSentEmail } from '../../../emails/QuoteSentEmail'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sales')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sales.quotes.manage'] },\n}\n\ntype RequestContext = {\n  ctx: CommandRuntimeContext\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function runGuards(\n  ctx: CommandRuntimeContext,\n  input: MutationGuardInput,\n): Promise<{\n  ok: boolean\n  errorBody?: Record<string, unknown>\n  errorStatus?: number\n  afterSuccessCallbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>\n}> {\n  const legacyGuard = bridgeLegacyGuard(ctx.container)\n  if (!legacyGuard) {\n    return { ok: true, afterSuccessCallbacks: [] }\n  }\n\n  return runMutationGuards([legacyGuard], input, {\n    userFeatures: resolveUserFeatures(ctx.auth),\n  })\n}\n\nasync function runGuardAfterSuccessCallbacks(\n  callbacks: Array<{ guard: MutationGuard; metadata: Record<string, unknown> | null }>,\n  input: {\n    tenantId: string\n    organizationId: string | null\n    userId: string\n    resourceKind: string\n    resourceId: string\n    operation: 'create' | 'update' | 'delete'\n    requestMethod: string\n    requestHeaders: Headers\n  },\n): Promise<void> {\n  for (const callback of callbacks) {\n    if (!callback.guard.afterSuccess) continue\n    await callback.guard.afterSuccess({\n      ...input,\n      metadata: callback.metadata ?? null,\n    })\n  }\n}\n\nasync function resolveRequestContext(req: Request): Promise<RequestContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('sales.documents.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, {\n      error: translate('sales.documents.errors.organization_required', 'Organization context is required'),\n    })\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return { ctx }\n}\n\nfunction resolveQuoteEmail(quote: SalesQuote): string | null {\n  const normalizeRecord = (value: unknown): Record<string, unknown> | null => {\n    if (value && typeof value === 'object' && !Array.isArray(value)) return value as Record<string, unknown>\n    if (typeof value !== 'string') return null\n    const parsed = parseDecryptedFieldValue(value)\n    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : null\n  }\n  const snapshot = normalizeRecord(quote.customerSnapshot)\n  const metadata = normalizeRecord(quote.metadata)\n  const contact = snapshot?.contact as Record<string, unknown> | undefined\n  const customer = snapshot?.customer as Record<string, unknown> | undefined\n  const candidate =\n    (typeof contact?.email === 'string' && contact.email.trim()) ||\n    (typeof customer?.primaryEmail === 'string' && customer.primaryEmail.trim()) ||\n    (typeof metadata?.customerEmail === 'string' && metadata.customerEmail.trim()) ||\n    null\n  if (!candidate) return null\n  const parsed = z.string().email().safeParse(candidate)\n  return parsed.success ? parsed.data : null\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx } = await resolveRequestContext(req)\n    const { translate } = await resolveTranslations()\n    const payload = await req.json().catch(() => ({}))\n    const scoped = withScopedPayload(payload ?? {}, ctx, translate)\n    const input = quoteSendSchema.parse(scoped)\n    const guardResult = await runGuards(ctx, {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: 'sales.quote',\n      resourceId: input.quoteId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n    }\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const tenantScope = ctx.auth?.tenantId\n      ? { tenantId: ctx.auth.tenantId, organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null }\n      : undefined\n    const quote = await findOneWithDecryption(em, SalesQuote, { id: input.quoteId, deletedAt: null }, {}, tenantScope)\n    if (!quote) {\n      throw notFound(translate('sales.documents.detail.error', 'Document not found or inaccessible.'))\n    }\n    if (quote.tenantId !== ctx.auth?.tenantId || quote.organizationId !== ctx.selectedOrganizationId) {\n      throw new CrudHttpError(403, { error: translate('sales.documents.errors.forbidden', 'Forbidden') })\n    }\n\n    if ((quote.status ?? null) === 'canceled') {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.canceled', 'Canceled quotes cannot be sent.') })\n    }\n\n    const email = resolveQuoteEmail(quote)\n    if (!email) {\n      throw new CrudHttpError(400, { error: translate('sales.quotes.send.missingEmail', 'Customer email is required to send a quote.') })\n    }\n\n    const now = new Date()\n    const validUntil = new Date(now)\n    validUntil.setUTCDate(validUntil.getUTCDate() + input.validForDays)\n\n    const rawAcceptanceToken = crypto.randomUUID()\n\n    // Persist the send state (status/token/sentAt) atomically and commit it\n    // BEFORE the email goes out, so a customer never receives a link whose\n    // acceptance token was not durably stored.\n    await em.transactional(async (tx) => {\n      quote.validUntil = validUntil\n      quote.acceptanceToken = hashAuthToken(rawAcceptanceToken)\n      quote.sentAt = now\n      quote.status = 'sent'\n      quote.statusEntryId = await resolveStatusEntryIdByValue(tx, {\n        tenantId: quote.tenantId,\n        organizationId: quote.organizationId,\n        value: 'sent',\n      })\n      quote.updatedAt = now\n      tx.persist(quote)\n    })\n\n    const appUrl = process.env.APP_URL || ''\n    const url = appUrl ? `${appUrl.replace(/\\/$/, '')}/quote/${rawAcceptanceToken}` : `/quote/${rawAcceptanceToken}`\n\n    const locale = await detectLocale()\n    const validUntilFormatted = validUntil.toLocaleDateString(locale, {\n      year: 'numeric',\n      month: 'long',\n      day: 'numeric',\n    })\n\n    const copy = {\n      preview: translate('sales.quotes.email.preview', 'Quote {quoteNumber} is ready for review', { quoteNumber: quote.quoteNumber }),\n      heading: translate('sales.quotes.email.heading', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      total: translate('sales.quotes.email.total', 'Total: {amount} {currency}', {\n        amount: quote.grandTotalGrossAmount ?? quote.grandTotalNetAmount ?? '0',\n        currency: quote.currencyCode,\n      }),\n      validUntil: translate('sales.quotes.email.validUntil', 'Valid until: {date}', { date: validUntilFormatted }),\n      cta: translate('sales.quotes.email.cta', 'View quote'),\n      footer: translate('sales.quotes.email.footer', 'Open Mercato'),\n    }\n\n    // Side effect after commit: an email failure must not roll back the send state.\n    await sendEmail({\n      to: email,\n      subject: translate('sales.quotes.email.subject', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),\n      react: QuoteSentEmail({ url, copy }),\n      tenantId: quote.tenantId,\n      organizationId: quote.organizationId,\n    })\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runGuardAfterSuccessCallbacks(guardResult.afterSuccessCallbacks, {\n        tenantId: ctx.auth?.tenantId ?? '',\n        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: 'sales.quote',\n        resourceId: input.quoteId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('sales.quotes.send failed', { err })\n    return NextResponse.json(\n      { error: translate('sales.quotes.send.failed', 'Failed to send quote.') },\n      { status: 400 }\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Sales',\n  summary: 'Send quote to customer',\n  methods: {\n    POST: {\n      summary: 'Send quote',\n      requestBody: {\n        contentType: 'application/json',\n        schema: quoteSendSchema,\n      },\n      responses: [\n        { status: 200, description: 'Email queued', schema: z.object({ ok: z.literal(true) }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'Not found', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Conflict detected', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n        { status: 423, description: 'Record locked', schema: z.object({ error: z.string(), code: z.string().optional() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,qBAAqB,oBAAoB;AAClD,SAAS,eAAe,iBAAiB,gBAAgB;AAEzD;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEP,OAAO,YAAY;AACnB,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,gCAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAAS,iBAAiB;AAC1B,SAAS,mCAAmC;AAC5C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAMA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,UACb,KACA,OAMC;AACD,QAAM,cAAc,kBAAkB,IAAI,SAAS;AACnD,MAAI,CAAC,aAAa;AAChB,WAAO,EAAE,IAAI,MAAM,uBAAuB,CAAC,EAAE;AAAA,EAC/C;AAEA,SAAO,kBAAkB,CAAC,WAAW,GAAG,OAAO;AAAA,IAC7C,cAAc,oBAAoB,IAAI,IAAI;AAAA,EAC5C,CAAC;AACH;AAEA,eAAe,8BACb,WACA,OAUe;AACf,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC,GAAG;AAAA,MACH,UAAU,SAAS,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB,KAAuC;AAC1E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,gDAAgD,kCAAkC;AAAA,IACrG,CAAC;AAAA,EACH;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO,EAAE,IAAI;AACf;AAEA,SAAS,kBAAkB,OAAkC;AAC3D,QAAM,kBAAkB,CAAC,UAAmD;AAC1E,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAMA,UAAS,yBAAyB,KAAK;AAC7C,WAAOA,WAAU,OAAOA,YAAW,YAAY,CAAC,MAAM,QAAQA,OAAM,IAChEA,UACA;AAAA,EACN;AACA,QAAM,WAAW,gBAAgB,MAAM,gBAAgB;AACvD,QAAMC,YAAW,gBAAgB,MAAM,QAAQ;AAC/C,QAAM,UAAU,UAAU;AAC1B,QAAM,WAAW,UAAU;AAC3B,QAAM,YACH,OAAO,SAAS,UAAU,YAAY,QAAQ,MAAM,KAAK,KACzD,OAAO,UAAU,iBAAiB,YAAY,SAAS,aAAa,KAAK,KACzE,OAAOA,WAAU,kBAAkB,YAAYA,UAAS,cAAc,KAAK,KAC5E;AACF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,SAAS;AACrD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,KAAK,SAAS;AAC9D,UAAM,QAAQ,gBAAgB,MAAM,MAAM;AAC1C,UAAM,cAAc,MAAM,UAAU,KAAK;AAAA,MACvC,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,IACvI;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,cAAc,IAAI,MAAM,WAC1B,EAAE,UAAU,IAAI,KAAK,UAAU,gBAAgB,IAAI,0BAA0B,IAAI,KAAK,SAAS,KAAK,IACpG;AACJ,UAAM,QAAQ,MAAM,sBAAsB,IAAI,YAAY,EAAE,IAAI,MAAM,SAAS,WAAW,KAAK,GAAG,CAAC,GAAG,WAAW;AACjH,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,UAAU,gCAAgC,qCAAqC,CAAC;AAAA,IACjG;AACA,QAAI,MAAM,aAAa,IAAI,MAAM,YAAY,MAAM,mBAAmB,IAAI,wBAAwB;AAChG,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,WAAW,EAAE,CAAC;AAAA,IACpG;AAEA,SAAK,MAAM,UAAU,UAAU,YAAY;AACzC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8BAA8B,iCAAiC,EAAE,CAAC;AAAA,IACpH;AAEA,UAAM,QAAQ,kBAAkB,KAAK;AACrC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,6CAA6C,EAAE,CAAC;AAAA,IACpI;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,aAAa,IAAI,KAAK,GAAG;AAC/B,eAAW,WAAW,WAAW,WAAW,IAAI,MAAM,YAAY;AAElE,UAAM,qBAAqB,OAAO,WAAW;AAK7C,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,aAAa;AACnB,YAAM,kBAAkB,cAAc,kBAAkB;AACxD,YAAM,SAAS;AACf,YAAM,SAAS;AACf,YAAM,gBAAgB,MAAM,4BAA4B,IAAI;AAAA,QAC1D,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,YAAY;AAClB,SAAG,QAAQ,KAAK;AAAA,IAClB,CAAC;AAED,UAAM,SAAS,QAAQ,IAAI,WAAW;AACtC,UAAM,MAAM,SAAS,GAAG,OAAO,QAAQ,OAAO,EAAE,CAAC,UAAU,kBAAkB,KAAK,UAAU,kBAAkB;AAE9G,UAAM,SAAS,MAAM,aAAa;AAClC,UAAM,sBAAsB,WAAW,mBAAmB,QAAQ;AAAA,MAChE,MAAM;AAAA,MACN,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAED,UAAM,OAAO;AAAA,MACX,SAAS,UAAU,8BAA8B,2CAA2C,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC9H,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,UAAU,4BAA4B,8BAA8B;AAAA,QACzE,QAAQ,MAAM,yBAAyB,MAAM,uBAAuB;AAAA,QACpE,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,MACD,YAAY,UAAU,iCAAiC,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAAA,MAC3G,KAAK,UAAU,0BAA0B,YAAY;AAAA,MACrD,QAAQ,UAAU,6BAA6B,cAAc;AAAA,IAC/D;AAGA,UAAM,UAAU;AAAA,MACd,IAAI;AAAA,MACJ,SAAS,UAAU,8BAA8B,uBAAuB,EAAE,aAAa,MAAM,YAAY,CAAC;AAAA,MAC1G,OAAO,eAAe,EAAE,KAAK,KAAK,CAAC;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AAED,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,8BAA8B,YAAY,uBAAuB;AAAA,QACrE,UAAU,IAAI,MAAM,YAAY;AAAA,QAChC,gBAAgB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAAA,QACjE,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,4BAA4B,uBAAuB,EAAE;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QACtH,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["parsed", "metadata"]
 }

package/dist/modules/sales/api/settings/document-numbers/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { salesSettingsUpsertSchema } from "../../../data/validators.js";
@@ -29,7 +30,7 @@ async function resolveSettingsContext(req) {
     throw new CrudHttpError(401, { error: translate("sales.settings.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate("sales.settings.errors.organization_required", "Organization context is required")
@@ -173,6 +174,11 @@ const openApi = {
       responses: [
         { status: 200, description: "Updated numbering formats and counters", schema: settingsResponseSchema },
         { status: 401, description: "Unauthorized", schema: settingsErrorSchema },
+        {
+          status: 403,
+          description: "Changing a counter requires sales.documents.number.edit",
+          schema: settingsErrorSchema
+        },
         { status: 400, description: "Invalid payload", schema: settingsErrorSchema }
       ]
     }