@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/customers/api/interactions/counts/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/interactions/counts/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { applyEmailVisibilityFilter } from '../../../lib/visibilityFilter'\nimport { TERMINAL_INTERACTION_STATUS_LIST } from '../../../lib/interactionStatus'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst querySchema = z.object({\n  entityId: z.string().uuid(),\n  // `open` counts every non-terminal status (planned/in_progress/waiting + any custom status);\n  // `planned` is kept as the BC alias for callers that used it to mean \"open\".\n  status: z.enum(['done', 'planned', 'open']).optional(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    call: z.number(),\n    email: z.number(),\n    meeting: z.number(),\n    note: z.number(),\n    task: z.number(),\n    total: z.number(),\n  }),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.interactions.view'] },\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'Get interaction counts by type',\n      description: 'Returns per-type interaction counts scoped to an entity.',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Counts by interaction type',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const queryUrl = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(queryUrl.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, {\n        error: translate('customers.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0\n      ? scope.filterIds\n      : auth.orgId\n        ? [auth.orgId]\n        : []\n    const em = (container.resolve('em') as EntityManager).fork()\n    const kysely = em.getKysely<any>()\n\n    let baseQuery = (kysely as any)\n      .selectFrom('customer_interactions')\n      .where('entity_id', '=', query.entityId)\n      .where('tenant_id', '=', auth.tenantId)\n      .where('deleted_at', 'is', null)\n\n    if (organizationIds.length === 1) {\n      baseQuery = baseQuery.where('organization_id', '=', organizationIds[0])\n    } else if (organizationIds.length > 1) {\n      baseQuery = baseQuery.where('organization_id', 'in', organizationIds)\n    }\n\n    if (query.status === 'open' || query.status === 'planned') {\n      baseQuery = baseQuery.where('status', 'not in', [...TERMINAL_INTERACTION_STATUS_LIST])\n    } else if (query.status) {\n      baseQuery = baseQuery.where('status', '=', query.status)\n    }\n\n    // Per-user email privacy: exclude other users' private emails from the\n    // per-type counts so the `email` total matches the visibility-filtered list.\n    // v1 strict owner-only \u2014 no admin bypass (the filter ignores caller features).\n    const viewerUserId = auth.isApiKey ? null : auth.sub ?? null\n    baseQuery = applyEmailVisibilityFilter(baseQuery, {\n      currentUserId: viewerUserId,\n      userFeatures: undefined,\n    })\n\n    // Raw SELECT: reads only unencrypted columns (id, interaction_type); title/notes are excluded to avoid ciphertext leakage.\n    const rows = await baseQuery\n      .select(['interaction_type', sql<string>`count(*)`.as('count')])\n      .groupBy('interaction_type')\n      .execute() as Array<{ interaction_type: string; count: string | number }>\n\n    const counts: Record<string, number> = { call: 0, email: 0, meeting: 0, note: 0, task: 0 }\n    let total = 0\n    for (const row of rows) {\n      const count = typeof row.count === 'string' ? parseInt(row.count, 10) : row.count\n      const type = row.interaction_type\n      if (type in counts) {\n        counts[type] = count\n      }\n      total += count\n    }\n\n    return NextResponse.json({ ok: true, result: { ...counts, total } })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('GET failed', { component: 'interactions/counts', err })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAW;AACpB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B;AAEpC,SAAS,kCAAkC;AAC3C,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO;AAAA,IAClB,MAAM,EAAE,OAAO;AAAA,IACf,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACH,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC7E;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,IAAI,GAAG;AAChC,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,SAAS,YAAY,CAAC;AACzE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,iCAAiC,cAAc;AAAA,MAClE,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,kBAAkB,MAAM,QAAQ,OAAO,SAAS,KAAK,MAAM,UAAU,SAAS,IAChF,MAAM,YACN,KAAK,QACH,CAAC,KAAK,KAAK,IACX,CAAC;AACP,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,GAAG,UAAe;AAEjC,QAAI,YAAa,OACd,WAAW,uBAAuB,EAClC,MAAM,aAAa,KAAK,MAAM,QAAQ,EACtC,MAAM,aAAa,KAAK,KAAK,QAAQ,EACrC,MAAM,cAAc,MAAM,IAAI;AAEjC,QAAI,gBAAgB,WAAW,GAAG;AAChC,kBAAY,UAAU,MAAM,mBAAmB,KAAK,gBAAgB,CAAC,CAAC;AAAA,IACxE,WAAW,gBAAgB,SAAS,GAAG;AACrC,kBAAY,UAAU,MAAM,mBAAmB,MAAM,eAAe;AAAA,IACtE;AAEA,QAAI,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AACzD,kBAAY,UAAU,MAAM,UAAU,UAAU,CAAC,GAAG,gCAAgC,CAAC;AAAA,IACvF,WAAW,MAAM,QAAQ;AACvB,kBAAY,UAAU,MAAM,UAAU,KAAK,MAAM,MAAM;AAAA,IACzD;AAKA,UAAM,eAAe,KAAK,WAAW,OAAO,KAAK,OAAO;AACxD,gBAAY,2BAA2B,WAAW;AAAA,MAChD,eAAe;AAAA,MACf,cAAc;AAAA,IAChB,CAAC;AAGD,UAAM,OAAO,MAAM,UAChB,OAAO,CAAC,oBAAoB,cAAsB,GAAG,OAAO,CAAC,CAAC,EAC9D,QAAQ,kBAAkB,EAC1B,QAAQ;AAEX,UAAM,SAAiC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,EAAE;AACzF,QAAI,QAAQ;AACZ,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,SAAS,IAAI,OAAO,EAAE,IAAI,IAAI;AAC5E,YAAM,OAAO,IAAI;AACjB,UAAI,QAAQ,QAAQ;AAClB,eAAO,IAAI,IAAI;AAAA,MACjB;AACA,eAAS;AAAA,IACX;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC;AAAA,EACrE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,cAAc,EAAE,WAAW,uBAAuB,IAAI,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { applyEmailVisibilityFilter } from '../../../lib/visibilityFilter'\nimport { listGrantsForViewer, listSharedChannelIds } from '../../../lib/conversationShares'\nimport { TERMINAL_INTERACTION_STATUS_LIST } from '../../../lib/interactionStatus'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst querySchema = z.object({\n  entityId: z.string().uuid(),\n  // `open` counts every non-terminal status (planned/in_progress/waiting + any custom status);\n  // `planned` is kept as the BC alias for callers that used it to mean \"open\".\n  status: z.enum(['done', 'planned', 'open']).optional(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    call: z.number(),\n    email: z.number(),\n    meeting: z.number(),\n    note: z.number(),\n    task: z.number(),\n    total: z.number(),\n  }),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.interactions.view'] },\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'Get interaction counts by type',\n      description: 'Returns per-type interaction counts scoped to an entity.',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Counts by interaction type',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const queryUrl = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(queryUrl.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, {\n        error: translate('customers.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const { organizationIds } = resolveOrganizationScopeFilter(scope, auth)\n    if (organizationIds?.length === 0) {\n      return NextResponse.json({\n        ok: true,\n        result: { call: 0, email: 0, meeting: 0, note: 0, task: 0, total: 0 },\n      })\n    }\n    const em = (container.resolve('em') as EntityManager).fork()\n    const kysely = em.getKysely<any>()\n\n    let baseQuery = (kysely as any)\n      .selectFrom('customer_interactions')\n      .where('entity_id', '=', query.entityId)\n      .where('tenant_id', '=', auth.tenantId)\n      .where('deleted_at', 'is', null)\n\n    if (organizationIds?.length === 1) {\n      baseQuery = baseQuery.where('organization_id', '=', organizationIds[0])\n    } else if (organizationIds && organizationIds.length > 1) {\n      baseQuery = baseQuery.where('organization_id', 'in', organizationIds)\n    }\n\n    if (query.status === 'open' || query.status === 'planned') {\n      baseQuery = baseQuery.where('status', 'not in', [...TERMINAL_INTERACTION_STATUS_LIST])\n    } else if (query.status) {\n      baseQuery = baseQuery.where('status', '=', query.status)\n    }\n\n    // Per-user email privacy: exclude other users' private emails from the\n    // per-type counts so the `email` total matches the visibility-filtered list.\n    // v1 strict owner-only \u2014 no admin bypass (the filter ignores caller features).\n    const viewerUserId = auth.isApiKey ? null : auth.sub ?? null\n    // Conversation shares must widen the counts too, or the `email` total would\n    // disagree with the visibility-filtered list it labels.\n    const emailShareScope = {\n      tenantId: auth.tenantId as string,\n      // Grants are org-scoped; with a multi-org scope fall back to tenant-wide\n      // (the predicate still matches on person + owner, never on org alone).\n      organizationId: organizationIds?.length === 1 ? organizationIds[0] : null,\n    }\n    const [emailShareGrants, emailSharedChannelIds] = await Promise.all([\n      listGrantsForViewer(em, emailShareScope, viewerUserId),\n      listSharedChannelIds(em, emailShareScope, viewerUserId),\n    ])\n    baseQuery = applyEmailVisibilityFilter(baseQuery, {\n      currentUserId: viewerUserId,\n      userFeatures: undefined,\n      sharedConversations: emailShareGrants,\n      sharedChannelIds: emailSharedChannelIds,\n    })\n\n    // Raw SELECT: reads only unencrypted columns (id, interaction_type); title/notes are excluded to avoid ciphertext leakage.\n    const rows = await baseQuery\n      .select(['interaction_type', sql<string>`count(*)`.as('count')])\n      .groupBy('interaction_type')\n      .execute() as Array<{ interaction_type: string; count: string | number }>\n\n    const counts: Record<string, number> = { call: 0, email: 0, meeting: 0, note: 0, task: 0 }\n    let total = 0\n    for (const row of rows) {\n      const count = typeof row.count === 'string' ? parseInt(row.count, 10) : row.count\n      const type = row.interaction_type\n      if (type in counts) {\n        counts[type] = count\n      }\n      total += count\n    }\n\n    return NextResponse.json({ ok: true, result: { ...counts, total } })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('GET failed', { component: 'interactions/counts', err })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAW;AACpB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,2BAA2B;AAEpC,SAAS,kCAAkC;AAC3C,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAG1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,WAAW,MAAM,CAAC,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,IAChB,SAAS,EAAE,OAAO;AAAA,IAClB,MAAM,EAAE,OAAO;AAAA,IACf,MAAM,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,OAAO;AAAA,EAClB,CAAC;AACH,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC7E;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,IAAI,GAAG;AAChC,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,SAAS,YAAY,CAAC;AACzE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,iCAAiC,cAAc;AAAA,MAClE,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,EAAE,gBAAgB,IAAI,+BAA+B,OAAO,IAAI;AACtE,QAAI,iBAAiB,WAAW,GAAG;AACjC,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,MACtE,CAAC;AAAA,IACH;AACA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,SAAS,GAAG,UAAe;AAEjC,QAAI,YAAa,OACd,WAAW,uBAAuB,EAClC,MAAM,aAAa,KAAK,MAAM,QAAQ,EACtC,MAAM,aAAa,KAAK,KAAK,QAAQ,EACrC,MAAM,cAAc,MAAM,IAAI;AAEjC,QAAI,iBAAiB,WAAW,GAAG;AACjC,kBAAY,UAAU,MAAM,mBAAmB,KAAK,gBAAgB,CAAC,CAAC;AAAA,IACxE,WAAW,mBAAmB,gBAAgB,SAAS,GAAG;AACxD,kBAAY,UAAU,MAAM,mBAAmB,MAAM,eAAe;AAAA,IACtE;AAEA,QAAI,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AACzD,kBAAY,UAAU,MAAM,UAAU,UAAU,CAAC,GAAG,gCAAgC,CAAC;AAAA,IACvF,WAAW,MAAM,QAAQ;AACvB,kBAAY,UAAU,MAAM,UAAU,KAAK,MAAM,MAAM;AAAA,IACzD;AAKA,UAAM,eAAe,KAAK,WAAW,OAAO,KAAK,OAAO;AAGxD,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA;AAAA;AAAA,MAGf,gBAAgB,iBAAiB,WAAW,IAAI,gBAAgB,CAAC,IAAI;AAAA,IACvE;AACA,UAAM,CAAC,kBAAkB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,oBAAoB,IAAI,iBAAiB,YAAY;AAAA,MACrD,qBAAqB,IAAI,iBAAiB,YAAY;AAAA,IACxD,CAAC;AACD,gBAAY,2BAA2B,WAAW;AAAA,MAChD,eAAe;AAAA,MACf,cAAc;AAAA,MACd,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,IACpB,CAAC;AAGD,UAAM,OAAO,MAAM,UAChB,OAAO,CAAC,oBAAoB,cAAsB,GAAG,OAAO,CAAC,CAAC,EAC9D,QAAQ,kBAAkB,EAC1B,QAAQ;AAEX,UAAM,SAAiC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,EAAE;AACzF,QAAI,QAAQ;AACZ,eAAW,OAAO,MAAM;AACtB,YAAM,QAAQ,OAAO,IAAI,UAAU,WAAW,SAAS,IAAI,OAAO,EAAE,IAAI,IAAI;AAC5E,YAAM,OAAO,IAAI;AACjB,UAAI,QAAQ,QAAQ;AAClB,eAAO,IAAI,IAAI;AAAA,MACjB;AACA,eAAS;AAAA,IACX;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC;AAAA,EACrE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,cAAc,EAAE,WAAW,uBAAuB,IAAI,CAAC;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
   "names": []
 }

package/dist/modules/customers/api/interactions/route.js

@@ -13,6 +13,7 @@ import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CustomerDeal, CustomerInteraction } from "../../data/entities.js";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
@@ -24,6 +25,7 @@ import {
 } from "../openapi.js";
 import { CUSTOMER_INTERACTION_ENTITY_ID } from "../../lib/interactionCompatibility.js";
 import { applyEmailVisibilityFilter } from "../../lib/visibilityFilter.js";
+import { listGrantsForViewer, listSharedChannelIds } from "../../lib/conversationShares.js";
 import { resolveEncryptedSortPage } from "./encryptedSortPage.js";
 import { applyDecryptedFields } from "./decryptedFields.js";
 import { resolveCanonicalActivityTargetId } from "../../lib/legacyActivityBridge.js";
@@ -232,6 +234,10 @@ const INTERACTION_LIST_COLUMNS = [
   "participants",
   "reminder_minutes",
   "visibility",
+  // Required by `interactionEmailCardEnricher`: without `channel_id` the
+  // shared-team-mailbox arm of `isEmailHiddenFrom` can never match, so a teammate
+  // silently loses the email-card actions on a mailbox they may legitimately read.
+  "channel_id",
   "linked_entities",
   "guest_permissions",
   "pinned",
@@ -242,7 +248,7 @@ const INTERACTION_LIST_COLUMNS = [
 ];
 function applyInteractionListFilters(baseQuery, params) {
   let q = baseQuery.where("deleted_at", "is", null).where("tenant_id", "=", params.tenantId);
-  if (params.organizationIds.length > 0) q = q.where("organization_id", "in", params.organizationIds);
+  if (params.organizationIds !== void 0) q = q.where("organization_id", "in", params.organizationIds);
   const { query } = params;
   if (query.entityId) q = q.where("entity_id", "=", query.entityId);
   if (query.dealId) q = q.where("deal_id", "=", query.dealId);
@@ -314,10 +320,7 @@ async function GET(req) {
       });
     }
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0 ? scope.filterIds : auth.orgId ? [auth.orgId] : [];
-    const selectedOrganizationId = scope?.selectedId ?? auth.orgId ?? organizationIds[0] ?? null;
-    const em = container.resolve("em").fork();
-    const db = em.getKysely();
+    const { organizationIds, rbacOrganizationId: selectedOrganizationId } = resolveOrganizationScopeFilter(scope, auth);
     const requestedSortField = query.sortField ?? "scheduledAt";
     const sortConfig = interactionSortConfig[requestedSortField];
     const sortDir = query.sortDir ?? sortConfig.defaultDir;
@@ -328,7 +331,20 @@ async function GET(req) {
         error: translate("customers.interactions.cursor.invalid", "Invalid cursor")
       });
     }
+    if (organizationIds?.length === 0) {
+      return NextResponse.json({ items: [] });
+    }
+    const em = container.resolve("em").fork();
+    const db = em.getKysely();
     const viewerUserId = auth.isApiKey ? null : auth.sub ?? null;
+    const emailShareScope = {
+      tenantId: auth.tenantId,
+      organizationId: selectedOrganizationId
+    };
+    const [emailShareGrants, emailSharedChannelIds] = await Promise.all([
+      listGrantsForViewer(em, emailShareScope, viewerUserId),
+      listSharedChannelIds(em, emailShareScope, viewerUserId)
+    ]);
     const encryptionService = resolveTenantEncryptionService(em);
     const [callerUserFeatures, encryptedSortFields] = await Promise.all([
       viewerUserId ? resolveUserFeatures(container, viewerUserId, auth.tenantId ?? null, selectedOrganizationId) : Promise.resolve(void 0),
@@ -350,7 +366,9 @@ async function GET(req) {
       );
       candidateQuery = applyEmailVisibilityFilter(candidateQuery, {
         currentUserId: viewerUserId,
-        userFeatures: callerUserFeatures
+        userFeatures: callerUserFeatures,
+        sharedConversations: emailShareGrants,
+        sharedChannelIds: emailSharedChannelIds
       });
       const cap = resolveEncryptedSortMaxRows();
       if (cap !== null) {
@@ -393,7 +411,9 @@ async function GET(req) {
         );
         pageQuery = applyEmailVisibilityFilter(pageQuery, {
           currentUserId: viewerUserId,
-          userFeatures: callerUserFeatures
+          userFeatures: callerUserFeatures,
+          sharedConversations: emailShareGrants,
+          sharedChannelIds: emailSharedChannelIds
         });
         pageQuery = pageQuery.where("id", "in", pageIds);
         const rawPageRows = await pageQuery.execute();
@@ -419,7 +439,9 @@ async function GET(req) {
       }
       rowsQuery = applyEmailVisibilityFilter(rowsQuery, {
         currentUserId: viewerUserId,
-        userFeatures: callerUserFeatures
+        userFeatures: callerUserFeatures,
+        sharedConversations: emailShareGrants,
+        sharedChannelIds: emailSharedChannelIds
       });
       rowsQuery = rowsQuery.orderBy(sql`${sql.raw(sortSql)} ${sql.raw(sortDir)}`).orderBy("id", sortDir);
       const rows = await rowsQuery.execute();
@@ -505,6 +527,7 @@ async function GET(req) {
       participants: row.participants ?? null,
       reminderMinutes: row.reminder_minutes ?? null,
       visibility: row.visibility ?? null,
+      channelId: row.channel_id ?? null,
       linkedEntities: row.linked_entities ?? null,
       guestPermissions: row.guest_permissions ?? null,
       pinned: row.pinned ?? false,

package/dist/modules/customers/api/interactions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customers/api/interactions/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'\nimport { applyResponseEnrichers } from '@open-mercato/shared/lib/crud/enricher-runner'\nimport type { EnricherContext } from '@open-mercato/shared/lib/crud/response-enricher'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { resolveEncryptedSortFields, resolveEncryptedSortMaxRows } from '@open-mercato/shared/lib/query/encrypted-sort'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CustomerDeal, CustomerInteraction } from '../../data/entities'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { interactionCreateSchema, interactionUpdateSchema } from '../../data/validators'\nimport { parseScopedCommandInput } from '../utils'\nimport {\n  createCustomersCrudOpenApi,\n  defaultOkResponseSchema,\n} from '../openapi'\nimport { CUSTOMER_INTERACTION_ENTITY_ID } from '../../lib/interactionCompatibility'\nimport { applyEmailVisibilityFilter } from '../../lib/visibilityFilter'\nimport { resolveEncryptedSortPage } from './encryptedSortPage'\nimport { applyDecryptedFields } from './decryptedFields'\nimport { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst interactionSortFieldSchema = z.enum([\n  'scheduledAt',\n  'occurredAt',\n  'createdAt',\n  'updatedAt',\n  'status',\n  'priority',\n  'interactionType',\n  'title',\n])\n\nexport const listSchema = z\n  .object({\n    limit: z.coerce.number().min(1).max(100).default(25),\n    cursor: z.string().optional(),\n    entityId: z.string().uuid().optional(),\n    dealId: z.string().uuid().optional(),\n    status: z.string().optional(),\n    interactionType: z.string().optional(),\n    type: z.string().optional(),\n    excludeInteractionType: z.string().optional(),\n    search: z.string().trim().min(1).optional(),\n    from: z.coerce.date().optional(),\n    to: z.coerce.date().optional(),\n    recurrenceMasters: z.enum(['true', 'false']).optional(),\n    pinned: z.enum(['true', 'false']).optional(),\n    sortField: interactionSortFieldSchema.optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.interactions.view'] },\n  POST: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: CustomerInteraction,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  enrichers: { entityId: 'customers.interaction' },\n  indexer: {\n    entityType: 'customers:customer_interaction',\n  },\n  actions: {\n    create: {\n      commandId: 'customers.interactions.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(interactionCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.interactionId ?? result?.id ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'customers.interactions.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(interactionUpdateSchema, raw ?? {}, ctx, translate)\n        // Bridge legacy `customer_activities` rows into `customer_interactions`\n        // before the canonical update runs so historical activities (#1807)\n        // remain editable through the new dialog. No-op when the canonical\n        // record already exists.\n        const tenantId = ctx.auth?.tenantId ?? null\n        if (typeof parsed.id === 'string' && tenantId) {\n          try {\n            const em = ctx.container.resolve('em') as EntityManager\n            const commandBus = ctx.container.resolve('commandBus') as CommandBus\n            const commandContext: CommandRuntimeContext = {\n              container: ctx.container,\n              auth: ctx.auth ?? null,\n              organizationScope: ctx.organizationScope ?? null,\n              selectedOrganizationId: ctx.selectedOrganizationId ?? null,\n              organizationIds: ctx.organizationIds ?? null,\n              request: ctx.request,\n            }\n            await resolveCanonicalActivityTargetId(em, commandBus, commandContext, parsed.id, tenantId)\n          } catch (err) {\n            // Bridging is best-effort; downstream lookup will surface a 404\n            // when neither canonical nor legacy rows exist.\n            logger.warn('Legacy interaction bridge failed', { component: 'interactions.put', id: parsed.id, err })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'customers.interactions.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          parsed?.body?.id ??\n          parsed?.id ??\n          parsed?.query?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('customers.errors.interaction_required', 'Interaction id is required'),\n          })\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nconst { POST, PUT, DELETE } = crud\n\nexport { POST, PUT, DELETE }\n\ntype InteractionListRow = {\n  id: string\n  entity_id: string\n  deal_id: string | null\n  interaction_type: string\n  title: string | null\n  body: string | null\n  status: string\n  scheduled_at: Date | null\n  occurred_at: Date | null\n  priority: number | null\n  author_user_id: string | null\n  owner_user_id: string | null\n  external_message_id: string | null\n  appearance_icon: string | null\n  appearance_color: string | null\n  source: string | null\n  duration_minutes: number | null\n  location: string | null\n  all_day: boolean | null\n  recurrence_rule: string | null\n  recurrence_end: Date | null\n  participants: Array<{ userId?: string; name?: string; email?: string; status?: string }> | null\n  reminder_minutes: number | null\n  visibility: string | null\n  linked_entities: Array<{ id: string; type: string; label: string }> | null\n  guest_permissions: { canInviteOthers?: boolean; canModify?: boolean; canSeeList?: boolean } | null\n  pinned: boolean\n  organization_id: string\n  tenant_id: string\n  created_at: Date\n  updated_at: Date\n  __sort_value: string | number | Date | null\n}\n\ntype CursorPayload = {\n  id: string\n  sortValue: string | number | null\n}\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (userId: string, input: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n}\n\nconst cursorSchema = z.object({\n  id: z.string().uuid(),\n  sortValue: z.union([z.string(), z.number(), z.null()]),\n})\n\nconst interactionSortConfig = {\n  scheduledAt: { column: 'scheduled_at', type: 'date' as const, defaultDir: 'asc' as const },\n  occurredAt: { column: 'occurred_at', type: 'date' as const, defaultDir: 'desc' as const },\n  createdAt: { column: 'created_at', type: 'date' as const, defaultDir: 'desc' as const },\n  updatedAt: { column: 'updated_at', type: 'date' as const, defaultDir: 'desc' as const },\n  status: { column: 'status', type: 'text' as const, defaultDir: 'asc' as const },\n  priority: { column: 'priority', type: 'number' as const, defaultDir: 'desc' as const },\n  interactionType: { column: 'interaction_type', type: 'text' as const, defaultDir: 'asc' as const },\n  title: { column: 'title', type: 'text' as const, defaultDir: 'asc' as const },\n} as const\n\nfunction toIsoString(value: unknown): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    return Number.isNaN(value.getTime()) ? null : value.toISOString()\n  }\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed.length) return null\n    const parsed = new Date(trimmed)\n    return Number.isNaN(parsed.getTime()) ? trimmed : parsed.toISOString()\n  }\n  return null\n}\n\nfunction normalizeCursorValue(\n  value: string | number | Date | null,\n  type: 'date' | 'number' | 'text',\n): string | number | null {\n  if (value == null) return null\n  if (type === 'number') {\n    if (typeof value === 'number' && Number.isFinite(value)) return value\n    if (typeof value === 'string') {\n      const parsed = Number(value)\n      return Number.isNaN(parsed) ? null : parsed\n    }\n    return null\n  }\n  if (type === 'date') {\n    return toIsoString(value)\n  }\n  if (typeof value === 'string') return value\n  if (value instanceof Date) return value.toISOString()\n  return String(value)\n}\n\nfunction encodeCursor(payload: CursorPayload): string {\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64')\n}\n\nfunction decodeCursor(token: string | undefined, type: 'date' | 'number' | 'text'): CursorPayload | null {\n  if (!token) return null\n  try {\n    const decoded = Buffer.from(token, 'base64').toString('utf8')\n    const parsed = cursorSchema.parse(JSON.parse(decoded))\n    return {\n      id: parsed.id,\n      sortValue: normalizeCursorValue(parsed.sortValue, type),\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction buildSortSql(\n  sortField: keyof typeof interactionSortConfig,\n  sortDir: 'asc' | 'desc',\n): string {\n  const config = interactionSortConfig[sortField]\n  if (config.type === 'date') {\n    const sentinel =\n      sortDir === 'asc'\n        ? \"timestamp with time zone '9999-12-31T23:59:59.999Z'\"\n        : \"timestamp with time zone '0001-01-01T00:00:00.000Z'\"\n    return `coalesce(${config.column}, ${sentinel})`\n  }\n  if (config.type === 'number') {\n    const sentinel = sortDir === 'asc' ? '2147483647' : '-2147483648'\n    return `coalesce(${config.column}, ${sentinel})`\n  }\n  const sentinel = sortDir === 'asc' ? \"'~~~~~~~~~~'\" : \"''\"\n  return `coalesce(${config.column}, ${sentinel})`\n}\n\nconst INTERACTION_LIST_COLUMNS = [\n  'id',\n  'entity_id',\n  'deal_id',\n  'interaction_type',\n  'title',\n  'body',\n  'status',\n  'scheduled_at',\n  'occurred_at',\n  'priority',\n  'author_user_id',\n  'owner_user_id',\n  'external_message_id',\n  'appearance_icon',\n  'appearance_color',\n  'source',\n  'duration_minutes',\n  'location',\n  'all_day',\n  'recurrence_rule',\n  'recurrence_end',\n  'participants',\n  'reminder_minutes',\n  'visibility',\n  'linked_entities',\n  'guest_permissions',\n  'pinned',\n  'organization_id',\n  'tenant_id',\n  'created_at',\n  'updated_at',\n] as const\n\n// Shared by both the SQL keyset path and the encrypted-sort candidate scan\n// so the two paths never drift on which rows are in scope.\nfunction applyInteractionListFilters(\n  baseQuery: any,\n  params: {\n    tenantId: string\n    organizationIds: string[]\n    query: z.infer<typeof listSchema>\n  },\n): any {\n  let q = baseQuery.where('deleted_at', 'is', null).where('tenant_id', '=', params.tenantId)\n  if (params.organizationIds.length > 0) q = q.where('organization_id', 'in', params.organizationIds)\n  const { query } = params\n  if (query.entityId) q = q.where('entity_id', '=', query.entityId)\n  if (query.dealId) q = q.where('deal_id', '=', query.dealId)\n  if (query.status) q = q.where('status', '=', query.status)\n  if (query.interactionType) q = q.where('interaction_type', '=', query.interactionType)\n  if (query.type) {\n    const types = query.type.split(',').map((t) => t.trim()).filter(Boolean)\n    if (types.length > 0) q = q.where('interaction_type', 'in', types)\n  }\n  if (query.pinned === 'true') {\n    q = q.where('pinned', '=', true)\n  } else if (query.pinned === 'false') {\n    q = q.where('pinned', '=', false)\n  }\n  if (query.excludeInteractionType) q = q.where('interaction_type', '!=', query.excludeInteractionType)\n  if (query.search) {\n    // NOTE: for tenants with data encryption enabled, `title`/`body` are\n    // ciphertext at rest (see encryption.ts), so this ILIKE matches encrypted\n    // bytes and returns no rows \u2014 substring search over encrypted free-text\n    // columns is unsupported, the same documented limitation as\n    // customer_activity / customer_comment. The returned page's title/body are\n    // still decrypted for display further below.\n    const searchTerm = `%${escapeLikePattern(query.search)}%`\n    q = q.where(sql<boolean>`coalesce(title, '') ilike ${searchTerm} or coalesce(body, '') ilike ${searchTerm}`)\n  }\n  if (query.recurrenceMasters === 'true') {\n    q = q.where('recurrence_rule', 'is not', null)\n    if (query.from) {\n      q = q.where(sql<boolean>`recurrence_end is null or recurrence_end >= ${query.from}`)\n    }\n    if (query.to) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)\n    }\n  } else {\n    if (query.from) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`)\n    }\n    if (query.to) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)\n    }\n  }\n  return q\n}\n\nasync function resolveUserFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return undefined\n    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\nasync function buildEnricherContext(\n  container: { resolve: (name: string) => unknown },\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,\n  organizationId: string | null,\n  precomputedUserFeatures?: { userId: string; features: string[] | undefined },\n): Promise<EnricherContext> {\n  const userId =\n    (typeof auth.sub === 'string' && auth.sub.trim().length > 0\n      ? auth.sub\n      : typeof auth.userId === 'string' && auth.userId.trim().length > 0\n        ? auth.userId\n        : typeof auth.keyId === 'string' && auth.keyId.trim().length > 0\n          ? auth.keyId\n          : 'system')\n\n  // Reuse features already resolved for this same user (the GET handler resolves\n  // them once for the visibility filter) to avoid a second RBAC lookup per request.\n  const userFeatures =\n    precomputedUserFeatures && precomputedUserFeatures.userId === userId\n      ? precomputedUserFeatures.features\n      : await resolveUserFeatures(container, userId, auth.tenantId ?? null, organizationId)\n\n  return {\n    organizationId: organizationId ?? '',\n    tenantId: auth.tenantId ?? '',\n    userId,\n    em: container.resolve('em'),\n    container,\n    userFeatures,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const queryUrl = new URL(req.url)\n    const query = listSchema.parse(Object.fromEntries(queryUrl.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, {\n        error: translate('customers.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0\n      ? scope.filterIds\n      : auth.orgId\n        ? [auth.orgId]\n        : []\n    const selectedOrganizationId = scope?.selectedId ?? auth.orgId ?? organizationIds[0] ?? null\n    const em = (container.resolve('em') as EntityManager).fork()\n    const db = em.getKysely<any>() as any\n\n    const requestedSortField = query.sortField ?? 'scheduledAt'\n    const sortConfig = interactionSortConfig[requestedSortField]\n    const sortDir = query.sortDir ?? sortConfig.defaultDir\n    const sortSql = buildSortSql(requestedSortField, sortDir)\n    const cursor = decodeCursor(query.cursor, sortConfig.type)\n    if (query.cursor && !cursor) {\n      throw new CrudHttpError(400, {\n        error: translate('customers.interactions.cursor.invalid', 'Invalid cursor'),\n      })\n    }\n\n    // \u2500\u2500 Email visibility filter (2026-05-27) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // Non-email interactions pass through; email rows with visibility='private'\n    // are filtered out unless the caller is the author or has admin bypass.\n    // API-key callers have no user identity (`auth.sub` undefined): resolve the\n    // viewer to null so they never gain the author bypass and only see shared\n    // emails (fail-closed). Mirrors counts/people/activities routes.\n    const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)\n    const encryptionService = resolveTenantEncryptionService(em)\n    // Encrypted sort columns can't use SQL keyset ordering on ciphertext, so an\n    // encrypted sort field takes a bounded candidate-scan + in-memory-sort path\n    // instead of the SQL path below. Resolved alongside the independent\n    // visibility-feature lookup rather than after it.\n    const [callerUserFeatures, encryptedSortFields] = await Promise.all([\n      viewerUserId\n        ? resolveUserFeatures(container, viewerUserId, auth.tenantId ?? null, selectedOrganizationId)\n        : Promise.resolve(undefined),\n      resolveEncryptedSortFields(\n        encryptionService,\n        CUSTOMER_INTERACTION_ENTITY_ID,\n        [sortConfig.column],\n        auth.tenantId,\n        selectedOrganizationId,\n      ),\n    ])\n    const sortFieldIsEncrypted = encryptedSortFields.has(sortConfig.column)\n\n    let pageRows: InteractionListRow[]\n    let hasMore: boolean\n\n    if (sortFieldIsEncrypted) {\n      let candidateQuery = applyInteractionListFilters(\n        db.selectFrom('customer_interactions').select(['id', sortConfig.column]),\n        { tenantId: auth.tenantId, organizationIds, query },\n      )\n      candidateQuery = applyEmailVisibilityFilter(candidateQuery as any, {\n        currentUserId: viewerUserId,\n        userFeatures: callerUserFeatures,\n      })\n      const cap = resolveEncryptedSortMaxRows()\n      if (cap !== null) {\n        candidateQuery = candidateQuery.limit(cap).orderBy('id', 'asc')\n      }\n      const candidateRows = await candidateQuery.execute() as Array<{ id: string } & Record<string, unknown>>\n      if (cap !== null && candidateRows.length >= cap) {\n        logger.warn('Encrypted sort candidate scan hit OM_ENCRYPTED_SORT_MAX_ROWS cap; results may be incomplete', {\n          component: 'interactions.GET',\n          cap,\n          sortField: sortConfig.column,\n          tenantId: auth.tenantId,\n        })\n      }\n\n      const decryptPayload = encryptionService?.decryptEntityPayload?.bind(encryptionService)\n      const { pageIds, hasMore: encryptedHasMore } = await resolveEncryptedSortPage({\n        candidates: candidateRows,\n        decryptRow: async (row) => {\n          if (!decryptPayload) return row\n          try {\n            const decrypted = await decryptPayload(CUSTOMER_INTERACTION_ENTITY_ID, row, auth.tenantId, selectedOrganizationId)\n            return { ...row, ...decrypted }\n          } catch (err) {\n            logger.error('error decrypting sort candidate', { component: 'interactions.GET', err })\n            return row\n          }\n        },\n        sortField: sortConfig.column,\n        sortDir,\n        cursorId: cursor?.id ?? null,\n        limit: query.limit,\n      })\n      hasMore = encryptedHasMore\n\n      if (pageIds.length === 0) {\n        pageRows = []\n      } else {\n        let pageQuery = applyInteractionListFilters(\n          db.selectFrom('customer_interactions').select([...INTERACTION_LIST_COLUMNS, sql`${sql.raw(sortSql)}`.as('__sort_value')]),\n          { tenantId: auth.tenantId, organizationIds, query },\n        )\n        pageQuery = applyEmailVisibilityFilter(pageQuery as any, {\n          currentUserId: viewerUserId,\n          userFeatures: callerUserFeatures,\n        })\n        pageQuery = pageQuery.where('id', 'in', pageIds)\n        const rawPageRows = await pageQuery.execute() as InteractionListRow[]\n        const byId = new Map(rawPageRows.map((row) => [row.id, row]))\n        pageRows = pageIds\n          .map((id) => byId.get(id))\n          .filter((row): row is InteractionListRow => row != null)\n      }\n    } else {\n      let rowsQuery = applyInteractionListFilters(\n        db\n          .selectFrom('customer_interactions')\n          .select([...INTERACTION_LIST_COLUMNS, sql`${sql.raw(sortSql)}`.as('__sort_value')])\n          .limit(query.limit + 1),\n        { tenantId: auth.tenantId, organizationIds, query },\n      )\n\n      if (cursor) {\n        const op = sortDir === 'asc' ? '>' : '<'\n        const opRaw = sql.raw(op)\n        const sortRaw = sql.raw(sortSql)\n        rowsQuery = rowsQuery.where((eb: any) => eb.or([\n          sql<boolean>`${sortRaw} ${opRaw} ${cursor.sortValue}`,\n          eb.and([\n            sql<boolean>`${sortRaw} = ${cursor.sortValue}`,\n            eb('id', op, cursor.id),\n          ]),\n        ]))\n      }\n\n      rowsQuery = applyEmailVisibilityFilter(rowsQuery as any, {\n        currentUserId: viewerUserId,\n        userFeatures: callerUserFeatures,\n      })\n\n      rowsQuery = rowsQuery.orderBy(sql`${sql.raw(sortSql)} ${sql.raw(sortDir)}`).orderBy('id', sortDir)\n\n      const rows = await rowsQuery.execute() as InteractionListRow[]\n      pageRows = rows.slice(0, query.limit)\n      hasMore = rows.length > query.limit\n    }\n\n    const authorIds = Array.from(\n      new Set(\n        pageRows\n          .map((row) => (typeof row.author_user_id === 'string' ? row.author_user_id : null))\n          .filter((value): value is string => !!value),\n      ),\n    )\n    const dealIds = Array.from(\n      new Set(\n        pageRows\n          .map((row) => (typeof row.deal_id === 'string' ? row.deal_id : null))\n          .filter((value): value is string => !!value),\n      ),\n    )\n    const interactionIds = pageRows.map((row) => row.id)\n    // A page can span the selected organization plus its descendants\n    // (organizationScope.ts expands a concrete selection that way), and\n    // encryption maps are resolved per organization with first-match-wins \u2014\n    // an org-specific map replaces rather than merges with the tenant-wide\n    // one. Resolving a single field set from `selectedOrganizationId` and\n    // applying it to every row therefore missed descendant-org fields the\n    // row's own map covers (#5945 follow-up). Each row's own\n    // `organization_id` is resolved instead, one lookup per distinct\n    // organization on the page \u2014 `getEncryptedFieldNames` memoizes per\n    // (entity, tenant, organization), so this adds no query for the common\n    // single-organization case.\n    const pageOrganizationIds = Array.from(\n      new Set(pageRows.map((row) => row.organization_id).filter((value): value is string => !!value)),\n    )\n\n    const [users, deals, customFieldValues, interactionRecords, encryptedFieldsByOrganization] = await Promise.all([\n      authorIds.length > 0 ? findWithDecryption(em, User, { id: { $in: authorIds } }, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId }) : Promise.resolve([]),\n      dealIds.length > 0 ? findWithDecryption(em, CustomerDeal, { id: { $in: dealIds } }, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId }) : Promise.resolve([]),\n      interactionIds.length > 0\n        ? loadCustomFieldValues({\n            em,\n            entityId: CUSTOMER_INTERACTION_ENTITY_ID,\n            recordIds: interactionIds,\n            tenantIdByRecord: Object.fromEntries(pageRows.map((row) => [row.id, row.tenant_id])),\n            organizationIdByRecord: Object.fromEntries(pageRows.map((row) => [row.id, row.organization_id])),\n            tenantFallbacks: [auth.tenantId].filter((value): value is string => !!value),\n          })\n        : Promise.resolve<Record<string, Record<string, unknown>>>({}),\n      interactionIds.length > 0\n        ? findWithDecryption(em, CustomerInteraction, { id: { $in: interactionIds } } as never, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId })\n        : Promise.resolve([]),\n      (async () => {\n        const byOrganization = new Map<string, readonly string[]>()\n        if (interactionIds.length === 0 || !encryptionService?.getEncryptedFieldNames || pageOrganizationIds.length === 0) {\n          return byOrganization\n        }\n        await Promise.all(pageOrganizationIds.map(async (organizationId) => {\n          const fields = await encryptionService.getEncryptedFieldNames(CUSTOMER_INTERACTION_ENTITY_ID, auth.tenantId, organizationId)\n          byOrganization.set(organizationId, fields)\n        }))\n        return byOrganization\n      })(),\n    ])\n\n    const userMap = new Map(\n      users.map((user) => [\n        user.id,\n        {\n          name: user.name ?? null,\n          email: user.email ?? null,\n        },\n      ]),\n    )\n    const dealMap = new Map(\n      deals.map((deal) => [deal.id, deal.title]),\n    )\n    // The kysely rows above carry raw column values, so every field the entity's\n    // encryption map covers arrives as ciphertext. findWithDecryption already\n    // returned those fields in plaintext, so the response takes them from the\n    // decrypted records. The covered set is read from each row's own\n    // organization's resolved map rather than hard-coded or shared across the\n    // page, so extending the map \u2014 or a page spanning several organizations \u2014\n    // cannot leave a field passing through as ciphertext (#5945).\n    const interactionRecordMap = new Map<string, CustomerInteraction>(\n      (interactionRecords as CustomerInteraction[]).map((record) => [record.id, record]),\n    )\n\n    const baseItems = pageRows.map((row) => applyDecryptedFields({\n      id: row.id,\n      entityId: row.entity_id,\n      dealId: row.deal_id ?? null,\n      interactionType: row.interaction_type,\n      title: row.title ?? null,\n      body: row.body ?? null,\n      status: row.status,\n      scheduledAt: toIsoString(row.scheduled_at),\n      occurredAt: toIsoString(row.occurred_at),\n      priority: row.priority ?? null,\n      authorUserId: row.author_user_id ?? null,\n      ownerUserId: row.owner_user_id ?? null,\n      externalMessageId: row.external_message_id ?? null,\n      appearanceIcon: row.appearance_icon ?? null,\n      appearanceColor: row.appearance_color ?? null,\n      source: row.source ?? null,\n      duration: row.duration_minutes ?? null,\n      durationMinutes: row.duration_minutes ?? null,\n      location: row.location ?? null,\n      allDay: row.all_day ?? null,\n      recurrenceRule: row.recurrence_rule ?? null,\n      recurrenceEnd: toIsoString(row.recurrence_end),\n      participants: row.participants ?? null,\n      reminderMinutes: row.reminder_minutes ?? null,\n      visibility: row.visibility ?? null,\n      linkedEntities: row.linked_entities ?? null,\n      guestPermissions: row.guest_permissions ?? null,\n      pinned: row.pinned ?? false,\n      organizationId: row.organization_id,\n      tenantId: row.tenant_id,\n      createdAt: toIsoString(row.created_at) ?? new Date().toISOString(),\n      updatedAt: toIsoString(row.updated_at) ?? new Date().toISOString(),\n      authorName: row.author_user_id ? userMap.get(row.author_user_id)?.name ?? null : null,\n      authorEmail: row.author_user_id ? userMap.get(row.author_user_id)?.email ?? null : null,\n      dealTitle: row.deal_id ? dealMap.get(row.deal_id) ?? null : null,\n      customValues: normalizeCustomFieldResponse(customFieldValues[row.id]) ?? null,\n    }, interactionRecordMap.get(row.id), encryptedFieldsByOrganization.get(row.organization_id) ?? []))\n\n    const enricherContext = await buildEnricherContext(\n      container,\n      auth,\n      selectedOrganizationId,\n      viewerUserId ? { userId: viewerUserId, features: callerUserFeatures } : undefined,\n    )\n    const enriched = await applyResponseEnrichers(baseItems, 'customers.interaction', enricherContext)\n\n    let nextCursor: string | undefined\n    if (hasMore && pageRows.length > 0) {\n      const last = pageRows[pageRows.length - 1]\n      nextCursor = encodeCursor({\n        id: last.id,\n        sortValue: normalizeCursorValue(last.__sort_value, sortConfig.type),\n      })\n    }\n\n    return NextResponse.json({\n      items: enriched.items,\n      nextCursor,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('customers.interactions.get failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('customers.interactions.load.error', 'Failed to load interactions.') },\n      { status: 500 },\n    )\n  }\n}\n\nconst interactionListItemSchema = z\n  .object({\n    id: z.string().uuid(),\n    entityId: z.string().uuid().nullable(),\n    dealId: z.string().uuid().nullable(),\n    interactionType: z.string(),\n    title: z.string().nullable(),\n    body: z.string().nullable(),\n    status: z.string(),\n    scheduledAt: z.string().nullable(),\n    occurredAt: z.string().nullable(),\n    priority: z.number().nullable(),\n    authorUserId: z.string().uuid().nullable(),\n    ownerUserId: z.string().uuid().nullable(),\n    externalMessageId: z.string().uuid().nullable().optional(),\n    appearanceIcon: z.string().nullable().optional(),\n    appearanceColor: z.string().nullable().optional(),\n    source: z.string().nullable().optional(),\n    duration: z.number().nullable().optional(),\n    durationMinutes: z.number().nullable().optional(),\n    location: z.string().nullable().optional(),\n    allDay: z.boolean().nullable().optional(),\n    recurrenceRule: z.string().nullable().optional(),\n    recurrenceEnd: z.string().nullable().optional(),\n    participants: z.array(\n      z.object({\n        userId: z\n          .string()\n          .uuid()\n          .optional()\n          .describe(\n            'Absent for an external guest, who has no person/customer/staff record and is identified by email instead. Identify a participant by userId when present, otherwise by its normalized email.',\n          ),\n        name: z.string().optional(),\n        email: z.string().optional(),\n        status: z.string().optional(),\n      }),\n    ).nullable().optional(),\n    reminderMinutes: z.number().nullable().optional(),\n    visibility: z.string().nullable().optional(),\n    linkedEntities: z.array(\n      z.object({\n        id: z.string().uuid(),\n        type: z.string(),\n        label: z.string(),\n      }),\n    ).nullable().optional(),\n    guestPermissions: z\n      .object({\n        canInviteOthers: z.boolean().optional(),\n        canModify: z.boolean().optional(),\n        canSeeList: z.boolean().optional(),\n      })\n      .nullable()\n      .optional(),\n    organizationId: z.string().uuid().nullable().optional(),\n    tenantId: z.string().uuid().nullable().optional(),\n    createdAt: z.string().nullable(),\n    updatedAt: z.string().nullable(),\n    authorName: z.string().nullable().optional(),\n    authorEmail: z.string().nullable().optional(),\n    dealTitle: z.string().nullable().optional(),\n    customValues: z.record(z.string(), z.unknown()).nullable().optional(),\n    _integrations: z.record(z.string(), z.unknown()).optional(),\n  })\n  .passthrough()\n\nconst interactionListResponseSchema = z.object({\n  items: z.array(interactionListItemSchema),\n  nextCursor: z.string().optional(),\n})\n\nconst interactionCreateResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nexport const openApi = createCustomersCrudOpenApi({\n  resourceName: 'Interaction',\n  querySchema: listSchema,\n  listResponseSchema: interactionListResponseSchema,\n  create: {\n    schema: interactionCreateSchema,\n    responseSchema: interactionCreateResponseSchema,\n    description: 'Creates a new interaction linked to a customer entity or deal.',\n  },\n  update: {\n    schema: interactionUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates fields for an existing interaction.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes an interaction identified by `id`. Accepts id via body or query string.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAW;AACpB,SAAS,qBAAqB;AAC9B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B;AAEvC,SAAS,0BAA0B;AACnC,SAAS,sCAAsC;AAC/C,SAAS,4BAA4B,mCAAmC;AACxE,SAAS,yBAAyB;AAClC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B;AACpC,SAAS,cAAc,2BAA2B;AAClD,SAAS,YAAY;AACrB,SAAS,yBAAyB,+BAA+B;AACjE,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,wCAAwC;AAEjD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,6BAA6B,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,MAAM,aAAa,EACvB,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,IAAI,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC7B,mBAAmB,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EAC3C,WAAW,2BAA2B,SAAS;AAAA,EAC/C,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,WAAW,EAAE,UAAU,wBAAwB;AAAA,EAC/C,SAAS;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACnF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,QAAQ,MAAM,KAAK;AAAA,MAC7E,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAKzF,cAAM,WAAW,IAAI,MAAM,YAAY;AACvC,YAAI,OAAO,OAAO,OAAO,YAAY,UAAU;AAC7C,cAAI;AACF,kBAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,kBAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,kBAAM,iBAAwC;AAAA,cAC5C,WAAW,IAAI;AAAA,cACf,MAAM,IAAI,QAAQ;AAAA,cAClB,mBAAmB,IAAI,qBAAqB;AAAA,cAC5C,wBAAwB,IAAI,0BAA0B;AAAA,cACtD,iBAAiB,IAAI,mBAAmB;AAAA,cACxC,SAAS,IAAI;AAAA,YACf;AACA,kBAAM,iCAAiC,IAAI,YAAY,gBAAgB,OAAO,IAAI,QAAQ;AAAA,UAC5F,SAAS,KAAK;AAGZ,mBAAO,KAAK,oCAAoC,EAAE,WAAW,oBAAoB,IAAI,OAAO,IAAI,IAAI,CAAC;AAAA,UACvG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,QAAQ,MAAM,MACd,QAAQ,MACR,QAAQ,OAAO,OACd,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,yCAAyC,4BAA4B;AAAA,UACxF,CAAC;AAAA,QACH;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI;AAgD9B,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,wBAAwB;AAAA,EAC5B,aAAa,EAAE,QAAQ,gBAAgB,MAAM,QAAiB,YAAY,MAAe;AAAA,EACzF,YAAY,EAAE,QAAQ,eAAe,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACxF,WAAW,EAAE,QAAQ,cAAc,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACtF,WAAW,EAAE,QAAQ,cAAc,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACtF,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAiB,YAAY,MAAe;AAAA,EAC9E,UAAU,EAAE,QAAQ,YAAY,MAAM,UAAmB,YAAY,OAAgB;AAAA,EACrF,iBAAiB,EAAE,QAAQ,oBAAoB,MAAM,QAAiB,YAAY,MAAe;AAAA,EACjG,OAAO,EAAE,QAAQ,SAAS,MAAM,QAAiB,YAAY,MAAe;AAC9E;AAEA,SAAS,YAAY,OAA+B;AAClD,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,WAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,OAAO,MAAM,YAAY;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,UAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,WAAO,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,UAAU,OAAO,YAAY;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,MACwB;AACxB,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,SAAS,UAAU;AACrB,QAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO;AAChE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,QAAQ;AACnB,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,aAAa,SAAgC;AACpD,SAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,EAAE,SAAS,QAAQ;AACvE;AAEA,SAAS,aAAa,OAA2B,MAAwD;AACvG,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAC5D,UAAM,SAAS,aAAa,MAAM,KAAK,MAAM,OAAO,CAAC;AACrD,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX,WAAW,qBAAqB,OAAO,WAAW,IAAI;AAAA,IACxD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aACP,WACA,SACQ;AACR,QAAM,SAAS,sBAAsB,SAAS;AAC9C,MAAI,OAAO,SAAS,QAAQ;AAC1B,UAAMA,YACJ,YAAY,QACR,wDACA;AACN,WAAO,YAAY,OAAO,MAAM,KAAKA,SAAQ;AAAA,EAC/C;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAMA,YAAW,YAAY,QAAQ,eAAe;AACpD,WAAO,YAAY,OAAO,MAAM,KAAKA,SAAQ;AAAA,EAC/C;AACA,QAAM,WAAW,YAAY,QAAQ,iBAAiB;AACtD,SAAO,YAAY,OAAO,MAAM,KAAK,QAAQ;AAC/C;AAEA,MAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,SAAS,4BACP,WACA,QAKK;AACL,MAAI,IAAI,UAAU,MAAM,cAAc,MAAM,IAAI,EAAE,MAAM,aAAa,KAAK,OAAO,QAAQ;AACzF,MAAI,OAAO,gBAAgB,SAAS,EAAG,KAAI,EAAE,MAAM,mBAAmB,MAAM,OAAO,eAAe;AAClG,QAAM,EAAE,MAAM,IAAI;AAClB,MAAI,MAAM,SAAU,KAAI,EAAE,MAAM,aAAa,KAAK,MAAM,QAAQ;AAChE,MAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,WAAW,KAAK,MAAM,MAAM;AAC1D,MAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,MAAM;AACzD,MAAI,MAAM,gBAAiB,KAAI,EAAE,MAAM,oBAAoB,KAAK,MAAM,eAAe;AACrF,MAAI,MAAM,MAAM;AACd,UAAM,QAAQ,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACvE,QAAI,MAAM,SAAS,EAAG,KAAI,EAAE,MAAM,oBAAoB,MAAM,KAAK;AAAA,EACnE;AACA,MAAI,MAAM,WAAW,QAAQ;AAC3B,QAAI,EAAE,MAAM,UAAU,KAAK,IAAI;AAAA,EACjC,WAAW,MAAM,WAAW,SAAS;AACnC,QAAI,EAAE,MAAM,UAAU,KAAK,KAAK;AAAA,EAClC;AACA,MAAI,MAAM,uBAAwB,KAAI,EAAE,MAAM,oBAAoB,MAAM,MAAM,sBAAsB;AACpG,MAAI,MAAM,QAAQ;AAOhB,UAAM,aAAa,IAAI,kBAAkB,MAAM,MAAM,CAAC;AACtD,QAAI,EAAE,MAAM,gCAAyC,UAAU,gCAAgC,UAAU,EAAE;AAAA,EAC7G;AACA,MAAI,MAAM,sBAAsB,QAAQ;AACtC,QAAI,EAAE,MAAM,mBAAmB,UAAU,IAAI;AAC7C,QAAI,MAAM,MAAM;AACd,UAAI,EAAE,MAAM,kDAA2D,MAAM,IAAI,EAAE;AAAA,IACrF;AACA,QAAI,MAAM,IAAI;AACZ,UAAI,EAAE,MAAM,yDAAkE,MAAM,EAAE,EAAE;AAAA,IAC1F;AAAA,EACF,OAAO;AACL,QAAI,MAAM,MAAM;AACd,UAAI,EAAE,MAAM,yDAAkE,MAAM,IAAI,EAAE;AAAA,IAC5F;AACA,QAAI,MAAM,IAAI;AACZ,UAAI,EAAE,MAAM,yDAAkE,MAAM,EAAE,EAAE;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,oBACb,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAO,MAAM,KAAK,mBAAmB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,qBACb,WACA,MACA,gBACA,yBAC0B;AAC1B,QAAM,SACH,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IACtD,KAAK,MACL,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,IAC7D,KAAK,SACL,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,IAC3D,KAAK,QACL;AAIV,QAAM,eACJ,2BAA2B,wBAAwB,WAAW,SAC1D,wBAAwB,WACxB,MAAM,oBAAoB,WAAW,QAAQ,KAAK,YAAY,MAAM,cAAc;AAExF,SAAO;AAAA,IACL,gBAAgB,kBAAkB;AAAA,IAClC,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,IACA,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,IAAI,GAAG;AAChC,UAAM,QAAQ,WAAW,MAAM,OAAO,YAAY,SAAS,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,iCAAiC,cAAc;AAAA,MAClE,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,kBAAkB,MAAM,QAAQ,OAAO,SAAS,KAAK,MAAM,UAAU,SAAS,IAChF,MAAM,YACN,KAAK,QACH,CAAC,KAAK,KAAK,IACX,CAAC;AACP,UAAM,yBAAyB,OAAO,cAAc,KAAK,SAAS,gBAAgB,CAAC,KAAK;AACxF,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,KAAK,GAAG,UAAe;AAE7B,UAAM,qBAAqB,MAAM,aAAa;AAC9C,UAAM,aAAa,sBAAsB,kBAAkB;AAC3D,UAAM,UAAU,MAAM,WAAW,WAAW;AAC5C,UAAM,UAAU,aAAa,oBAAoB,OAAO;AACxD,UAAM,SAAS,aAAa,MAAM,QAAQ,WAAW,IAAI;AACzD,QAAI,MAAM,UAAU,CAAC,QAAQ;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,gBAAgB;AAAA,MAC5E,CAAC;AAAA,IACH;AAQA,UAAM,eAAe,KAAK,WAAW,OAAQ,KAAK,OAAO;AACzD,UAAM,oBAAoB,+BAA+B,EAAE;AAK3D,UAAM,CAAC,oBAAoB,mBAAmB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,eACI,oBAAoB,WAAW,cAAc,KAAK,YAAY,MAAM,sBAAsB,IAC1F,QAAQ,QAAQ,MAAS;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,QACA,CAAC,WAAW,MAAM;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,uBAAuB,oBAAoB,IAAI,WAAW,MAAM;AAEtE,QAAI;AACJ,QAAI;AAEJ,QAAI,sBAAsB;AACxB,UAAI,iBAAiB;AAAA,QACnB,GAAG,WAAW,uBAAuB,EAAE,OAAO,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,QACvE,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,MACpD;AACA,uBAAiB,2BAA2B,gBAAuB;AAAA,QACjE,eAAe;AAAA,QACf,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,MAAM,4BAA4B;AACxC,UAAI,QAAQ,MAAM;AAChB,yBAAiB,eAAe,MAAM,GAAG,EAAE,QAAQ,MAAM,KAAK;AAAA,MAChE;AACA,YAAM,gBAAgB,MAAM,eAAe,QAAQ;AACnD,UAAI,QAAQ,QAAQ,cAAc,UAAU,KAAK;AAC/C,eAAO,KAAK,+FAA+F;AAAA,UACzG,WAAW;AAAA,UACX;AAAA,UACA,WAAW,WAAW;AAAA,UACtB,UAAU,KAAK;AAAA,QACjB,CAAC;AAAA,MACH;AAEA,YAAM,iBAAiB,mBAAmB,sBAAsB,KAAK,iBAAiB;AACtF,YAAM,EAAE,SAAS,SAAS,iBAAiB,IAAI,MAAM,yBAAyB;AAAA,QAC5E,YAAY;AAAA,QACZ,YAAY,OAAO,QAAQ;AACzB,cAAI,CAAC,eAAgB,QAAO;AAC5B,cAAI;AACF,kBAAM,YAAY,MAAM,eAAe,gCAAgC,KAAK,KAAK,UAAU,sBAAsB;AACjH,mBAAO,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,UAChC,SAAS,KAAK;AACZ,mBAAO,MAAM,mCAAmC,EAAE,WAAW,oBAAoB,IAAI,CAAC;AACtF,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA,WAAW,WAAW;AAAA,QACtB;AAAA,QACA,UAAU,QAAQ,MAAM;AAAA,QACxB,OAAO,MAAM;AAAA,MACf,CAAC;AACD,gBAAU;AAEV,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW,CAAC;AAAA,MACd,OAAO;AACL,YAAI,YAAY;AAAA,UACd,GAAG,WAAW,uBAAuB,EAAE,OAAO,CAAC,GAAG,0BAA0B,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;AAAA,UACxH,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,QACpD;AACA,oBAAY,2BAA2B,WAAkB;AAAA,UACvD,eAAe;AAAA,UACf,cAAc;AAAA,QAChB,CAAC;AACD,oBAAY,UAAU,MAAM,MAAM,MAAM,OAAO;AAC/C,cAAM,cAAc,MAAM,UAAU,QAAQ;AAC5C,cAAM,OAAO,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AAC5D,mBAAW,QACR,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,EACxB,OAAO,CAAC,QAAmC,OAAO,IAAI;AAAA,MAC3D;AAAA,IACF,OAAO;AACL,UAAI,YAAY;AAAA,QACd,GACG,WAAW,uBAAuB,EAClC,OAAO,CAAC,GAAG,0BAA0B,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,EACjF,MAAM,MAAM,QAAQ,CAAC;AAAA,QACxB,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,MACpD;AAEA,UAAI,QAAQ;AACV,cAAM,KAAK,YAAY,QAAQ,MAAM;AACrC,cAAM,QAAQ,IAAI,IAAI,EAAE;AACxB,cAAM,UAAU,IAAI,IAAI,OAAO;AAC/B,oBAAY,UAAU,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UAC7C,MAAe,OAAO,IAAI,KAAK,IAAI,OAAO,SAAS;AAAA,UACnD,GAAG,IAAI;AAAA,YACL,MAAe,OAAO,MAAM,OAAO,SAAS;AAAA,YAC5C,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,UACxB,CAAC;AAAA,QACH,CAAC,CAAC;AAAA,MACJ;AAEA,kBAAY,2BAA2B,WAAkB;AAAA,QACvD,eAAe;AAAA,QACf,cAAc;AAAA,MAChB,CAAC;AAED,kBAAY,UAAU,QAAQ,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,QAAQ,MAAM,OAAO;AAEjG,YAAM,OAAO,MAAM,UAAU,QAAQ;AACrC,iBAAW,KAAK,MAAM,GAAG,MAAM,KAAK;AACpC,gBAAU,KAAK,SAAS,MAAM;AAAA,IAChC;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB,IAAI;AAAA,QACF,SACG,IAAI,CAAC,QAAS,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB,IAAK,EACjF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,SACG,IAAI,CAAC,QAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,IAAK,EACnE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,iBAAiB,SAAS,IAAI,CAAC,QAAQ,IAAI,EAAE;AAYnD,UAAM,sBAAsB,MAAM;AAAA,MAChC,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK,CAAC;AAAA,IAChG;AAEA,UAAM,CAAC,OAAO,OAAO,mBAAmB,oBAAoB,6BAA6B,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7G,UAAU,SAAS,IAAI,mBAAmB,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACpL,QAAQ,SAAS,IAAI,mBAAmB,IAAI,cAAc,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACxL,eAAe,SAAS,IACpB,sBAAsB;AAAA,QACpB;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,QACX,kBAAkB,OAAO,YAAY,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC;AAAA,QACnF,wBAAwB,OAAO,YAAY,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,CAAC;AAAA,QAC/F,iBAAiB,CAAC,KAAK,QAAQ,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC7E,CAAC,IACD,QAAQ,QAAiD,CAAC,CAAC;AAAA,MAC/D,eAAe,SAAS,IACpB,mBAAmB,IAAI,qBAAqB,EAAE,IAAI,EAAE,KAAK,eAAe,EAAE,GAAY,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IACpK,QAAQ,QAAQ,CAAC,CAAC;AAAA,OACrB,YAAY;AACX,cAAM,iBAAiB,oBAAI,IAA+B;AAC1D,YAAI,eAAe,WAAW,KAAK,CAAC,mBAAmB,0BAA0B,oBAAoB,WAAW,GAAG;AACjH,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,IAAI,oBAAoB,IAAI,OAAO,mBAAmB;AAClE,gBAAM,SAAS,MAAM,kBAAkB,uBAAuB,gCAAgC,KAAK,UAAU,cAAc;AAC3H,yBAAe,IAAI,gBAAgB,MAAM;AAAA,QAC3C,CAAC,CAAC;AACF,eAAO;AAAA,MACT,GAAG;AAAA,IACL,CAAC;AAED,UAAM,UAAU,IAAI;AAAA,MAClB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,MAAM,KAAK,QAAQ;AAAA,UACnB,OAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,IAAI;AAAA,MAClB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,IAC3C;AAQA,UAAM,uBAAuB,IAAI;AAAA,MAC9B,mBAA6C,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC;AAAA,IACnF;AAEA,UAAM,YAAY,SAAS,IAAI,CAAC,QAAQ,qBAAqB;AAAA,MAC3D,IAAI,IAAI;AAAA,MACR,UAAU,IAAI;AAAA,MACd,QAAQ,IAAI,WAAW;AAAA,MACvB,iBAAiB,IAAI;AAAA,MACrB,OAAO,IAAI,SAAS;AAAA,MACpB,MAAM,IAAI,QAAQ;AAAA,MAClB,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,YAAY;AAAA,MACzC,YAAY,YAAY,IAAI,WAAW;AAAA,MACvC,UAAU,IAAI,YAAY;AAAA,MAC1B,cAAc,IAAI,kBAAkB;AAAA,MACpC,aAAa,IAAI,iBAAiB;AAAA,MAClC,mBAAmB,IAAI,uBAAuB;AAAA,MAC9C,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,QAAQ,IAAI,UAAU;AAAA,MACtB,UAAU,IAAI,oBAAoB;AAAA,MAClC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,UAAU,IAAI,YAAY;AAAA,MAC1B,QAAQ,IAAI,WAAW;AAAA,MACvB,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,eAAe,YAAY,IAAI,cAAc;AAAA,MAC7C,cAAc,IAAI,gBAAgB;AAAA,MAClC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,YAAY,IAAI,cAAc;AAAA,MAC9B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,kBAAkB,IAAI,qBAAqB;AAAA,MAC3C,QAAQ,IAAI,UAAU;AAAA,MACtB,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,WAAW,YAAY,IAAI,UAAU,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MACjE,WAAW,YAAY,IAAI,UAAU,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MACjE,YAAY,IAAI,iBAAiB,QAAQ,IAAI,IAAI,cAAc,GAAG,QAAQ,OAAO;AAAA,MACjF,aAAa,IAAI,iBAAiB,QAAQ,IAAI,IAAI,cAAc,GAAG,SAAS,OAAO;AAAA,MACnF,WAAW,IAAI,UAAU,QAAQ,IAAI,IAAI,OAAO,KAAK,OAAO;AAAA,MAC5D,cAAc,6BAA6B,kBAAkB,IAAI,EAAE,CAAC,KAAK;AAAA,IAC3E,GAAG,qBAAqB,IAAI,IAAI,EAAE,GAAG,8BAA8B,IAAI,IAAI,eAAe,KAAK,CAAC,CAAC,CAAC;AAElG,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,EAAE,QAAQ,cAAc,UAAU,mBAAmB,IAAI;AAAA,IAC1E;AACA,UAAM,WAAW,MAAM,uBAAuB,WAAW,yBAAyB,eAAe;AAEjG,QAAI;AACJ,QAAI,WAAW,SAAS,SAAS,GAAG;AAClC,YAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,mBAAa,aAAa;AAAA,QACxB,IAAI,KAAK;AAAA,QACT,WAAW,qBAAqB,KAAK,cAAc,WAAW,IAAI;AAAA,MACpE,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,8BAA8B,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAC/B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,cAAc,EAAE;AAAA,IACd,EAAE,OAAO;AAAA,MACP,QAAQ,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT;AAAA,QACC;AAAA,MACF;AAAA,MACF,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH,EAAE,SAAS,EAAE,SAAS;AAAA,EACtB,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE;AAAA,IAChB,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,OAAO,EAAE,OAAO;AAAA,IAClB,CAAC;AAAA,EACH,EAAE,SAAS,EAAE,SAAS;AAAA,EACtB,kBAAkB,EACf,OAAO;AAAA,IACN,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,IACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,EACZ,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,YAAY;AAEf,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,yBAAyB;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,UAAU,2BAA2B;AAAA,EAChD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'\nimport { applyResponseEnrichers } from '@open-mercato/shared/lib/crud/enricher-runner'\nimport type { EnricherContext } from '@open-mercato/shared/lib/crud/response-enricher'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'\nimport { resolveEncryptedSortFields, resolveEncryptedSortMaxRows } from '@open-mercato/shared/lib/query/encrypted-sort'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CustomerDeal, CustomerInteraction } from '../../data/entities'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { interactionCreateSchema, interactionUpdateSchema } from '../../data/validators'\nimport { parseScopedCommandInput } from '../utils'\nimport {\n  createCustomersCrudOpenApi,\n  defaultOkResponseSchema,\n} from '../openapi'\nimport { CUSTOMER_INTERACTION_ENTITY_ID } from '../../lib/interactionCompatibility'\nimport { applyEmailVisibilityFilter } from '../../lib/visibilityFilter'\nimport { listGrantsForViewer, listSharedChannelIds } from '../../lib/conversationShares'\nimport { resolveEncryptedSortPage } from './encryptedSortPage'\nimport { applyDecryptedFields } from './decryptedFields'\nimport { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst interactionSortFieldSchema = z.enum([\n  'scheduledAt',\n  'occurredAt',\n  'createdAt',\n  'updatedAt',\n  'status',\n  'priority',\n  'interactionType',\n  'title',\n])\n\nexport const listSchema = z\n  .object({\n    limit: z.coerce.number().min(1).max(100).default(25),\n    cursor: z.string().optional(),\n    entityId: z.string().uuid().optional(),\n    dealId: z.string().uuid().optional(),\n    status: z.string().optional(),\n    interactionType: z.string().optional(),\n    type: z.string().optional(),\n    excludeInteractionType: z.string().optional(),\n    search: z.string().trim().min(1).optional(),\n    from: z.coerce.date().optional(),\n    to: z.coerce.date().optional(),\n    recurrenceMasters: z.enum(['true', 'false']).optional(),\n    pinned: z.enum(['true', 'false']).optional(),\n    sortField: interactionSortFieldSchema.optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.interactions.view'] },\n  POST: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.interactions.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: CustomerInteraction,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  enrichers: { entityId: 'customers.interaction' },\n  indexer: {\n    entityType: 'customers:customer_interaction',\n  },\n  actions: {\n    create: {\n      commandId: 'customers.interactions.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        return parseScopedCommandInput(interactionCreateSchema, raw ?? {}, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.interactionId ?? result?.id ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'customers.interactions.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(interactionUpdateSchema, raw ?? {}, ctx, translate)\n        // Bridge legacy `customer_activities` rows into `customer_interactions`\n        // before the canonical update runs so historical activities (#1807)\n        // remain editable through the new dialog. No-op when the canonical\n        // record already exists.\n        const tenantId = ctx.auth?.tenantId ?? null\n        if (typeof parsed.id === 'string' && tenantId) {\n          try {\n            const em = ctx.container.resolve('em') as EntityManager\n            const commandBus = ctx.container.resolve('commandBus') as CommandBus\n            const commandContext: CommandRuntimeContext = {\n              container: ctx.container,\n              auth: ctx.auth ?? null,\n              organizationScope: ctx.organizationScope ?? null,\n              selectedOrganizationId: ctx.selectedOrganizationId ?? null,\n              organizationIds: ctx.organizationIds ?? null,\n              request: ctx.request,\n            }\n            await resolveCanonicalActivityTargetId(em, commandBus, commandContext, parsed.id, tenantId)\n          } catch (err) {\n            // Bridging is best-effort; downstream lookup will surface a 404\n            // when neither canonical nor legacy rows exist.\n            logger.warn('Legacy interaction bridge failed', { component: 'interactions.put', id: parsed.id, err })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'customers.interactions.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id =\n          parsed?.body?.id ??\n          parsed?.id ??\n          parsed?.query?.id ??\n          (ctx.request ? new URL(ctx.request.url).searchParams.get('id') : null)\n        if (!id) {\n          throw new CrudHttpError(400, {\n            error: translate('customers.errors.interaction_required', 'Interaction id is required'),\n          })\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nconst { POST, PUT, DELETE } = crud\n\nexport { POST, PUT, DELETE }\n\ntype InteractionListRow = {\n  id: string\n  entity_id: string\n  deal_id: string | null\n  interaction_type: string\n  title: string | null\n  body: string | null\n  status: string\n  scheduled_at: Date | null\n  occurred_at: Date | null\n  priority: number | null\n  author_user_id: string | null\n  owner_user_id: string | null\n  external_message_id: string | null\n  appearance_icon: string | null\n  appearance_color: string | null\n  source: string | null\n  duration_minutes: number | null\n  location: string | null\n  all_day: boolean | null\n  recurrence_rule: string | null\n  recurrence_end: Date | null\n  participants: Array<{ userId?: string; name?: string; email?: string; status?: string }> | null\n  reminder_minutes: number | null\n  visibility: string | null\n  /** Denormalized channel \u2014 the shared-team-mailbox arm keys on this, not on the author. */\n  channel_id: string | null\n  linked_entities: Array<{ id: string; type: string; label: string }> | null\n  guest_permissions: { canInviteOthers?: boolean; canModify?: boolean; canSeeList?: boolean } | null\n  pinned: boolean\n  organization_id: string\n  tenant_id: string\n  created_at: Date\n  updated_at: Date\n  __sort_value: string | number | Date | null\n}\n\ntype CursorPayload = {\n  id: string\n  sortValue: string | number | null\n}\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (userId: string, input: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>\n}\n\nconst cursorSchema = z.object({\n  id: z.string().uuid(),\n  sortValue: z.union([z.string(), z.number(), z.null()]),\n})\n\nconst interactionSortConfig = {\n  scheduledAt: { column: 'scheduled_at', type: 'date' as const, defaultDir: 'asc' as const },\n  occurredAt: { column: 'occurred_at', type: 'date' as const, defaultDir: 'desc' as const },\n  createdAt: { column: 'created_at', type: 'date' as const, defaultDir: 'desc' as const },\n  updatedAt: { column: 'updated_at', type: 'date' as const, defaultDir: 'desc' as const },\n  status: { column: 'status', type: 'text' as const, defaultDir: 'asc' as const },\n  priority: { column: 'priority', type: 'number' as const, defaultDir: 'desc' as const },\n  interactionType: { column: 'interaction_type', type: 'text' as const, defaultDir: 'asc' as const },\n  title: { column: 'title', type: 'text' as const, defaultDir: 'asc' as const },\n} as const\n\nfunction toIsoString(value: unknown): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    return Number.isNaN(value.getTime()) ? null : value.toISOString()\n  }\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed.length) return null\n    const parsed = new Date(trimmed)\n    return Number.isNaN(parsed.getTime()) ? trimmed : parsed.toISOString()\n  }\n  return null\n}\n\nfunction normalizeCursorValue(\n  value: string | number | Date | null,\n  type: 'date' | 'number' | 'text',\n): string | number | null {\n  if (value == null) return null\n  if (type === 'number') {\n    if (typeof value === 'number' && Number.isFinite(value)) return value\n    if (typeof value === 'string') {\n      const parsed = Number(value)\n      return Number.isNaN(parsed) ? null : parsed\n    }\n    return null\n  }\n  if (type === 'date') {\n    return toIsoString(value)\n  }\n  if (typeof value === 'string') return value\n  if (value instanceof Date) return value.toISOString()\n  return String(value)\n}\n\nfunction encodeCursor(payload: CursorPayload): string {\n  return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64')\n}\n\nfunction decodeCursor(token: string | undefined, type: 'date' | 'number' | 'text'): CursorPayload | null {\n  if (!token) return null\n  try {\n    const decoded = Buffer.from(token, 'base64').toString('utf8')\n    const parsed = cursorSchema.parse(JSON.parse(decoded))\n    return {\n      id: parsed.id,\n      sortValue: normalizeCursorValue(parsed.sortValue, type),\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction buildSortSql(\n  sortField: keyof typeof interactionSortConfig,\n  sortDir: 'asc' | 'desc',\n): string {\n  const config = interactionSortConfig[sortField]\n  if (config.type === 'date') {\n    const sentinel =\n      sortDir === 'asc'\n        ? \"timestamp with time zone '9999-12-31T23:59:59.999Z'\"\n        : \"timestamp with time zone '0001-01-01T00:00:00.000Z'\"\n    return `coalesce(${config.column}, ${sentinel})`\n  }\n  if (config.type === 'number') {\n    const sentinel = sortDir === 'asc' ? '2147483647' : '-2147483648'\n    return `coalesce(${config.column}, ${sentinel})`\n  }\n  const sentinel = sortDir === 'asc' ? \"'~~~~~~~~~~'\" : \"''\"\n  return `coalesce(${config.column}, ${sentinel})`\n}\n\nconst INTERACTION_LIST_COLUMNS = [\n  'id',\n  'entity_id',\n  'deal_id',\n  'interaction_type',\n  'title',\n  'body',\n  'status',\n  'scheduled_at',\n  'occurred_at',\n  'priority',\n  'author_user_id',\n  'owner_user_id',\n  'external_message_id',\n  'appearance_icon',\n  'appearance_color',\n  'source',\n  'duration_minutes',\n  'location',\n  'all_day',\n  'recurrence_rule',\n  'recurrence_end',\n  'participants',\n  'reminder_minutes',\n  'visibility',\n  // Required by `interactionEmailCardEnricher`: without `channel_id` the\n  // shared-team-mailbox arm of `isEmailHiddenFrom` can never match, so a teammate\n  // silently loses the email-card actions on a mailbox they may legitimately read.\n  'channel_id',\n  'linked_entities',\n  'guest_permissions',\n  'pinned',\n  'organization_id',\n  'tenant_id',\n  'created_at',\n  'updated_at',\n] as const\n\n// Shared by both the SQL keyset path and the encrypted-sort candidate scan\n// so the two paths never drift on which rows are in scope.\nfunction applyInteractionListFilters(\n  baseQuery: any,\n  params: {\n    tenantId: string\n    organizationIds: string[] | undefined\n    query: z.infer<typeof listSchema>\n  },\n): any {\n  let q = baseQuery.where('deleted_at', 'is', null).where('tenant_id', '=', params.tenantId)\n  if (params.organizationIds !== undefined) q = q.where('organization_id', 'in', params.organizationIds)\n  const { query } = params\n  if (query.entityId) q = q.where('entity_id', '=', query.entityId)\n  if (query.dealId) q = q.where('deal_id', '=', query.dealId)\n  if (query.status) q = q.where('status', '=', query.status)\n  if (query.interactionType) q = q.where('interaction_type', '=', query.interactionType)\n  if (query.type) {\n    const types = query.type.split(',').map((t) => t.trim()).filter(Boolean)\n    if (types.length > 0) q = q.where('interaction_type', 'in', types)\n  }\n  if (query.pinned === 'true') {\n    q = q.where('pinned', '=', true)\n  } else if (query.pinned === 'false') {\n    q = q.where('pinned', '=', false)\n  }\n  if (query.excludeInteractionType) q = q.where('interaction_type', '!=', query.excludeInteractionType)\n  if (query.search) {\n    // NOTE: for tenants with data encryption enabled, `title`/`body` are\n    // ciphertext at rest (see encryption.ts), so this ILIKE matches encrypted\n    // bytes and returns no rows \u2014 substring search over encrypted free-text\n    // columns is unsupported, the same documented limitation as\n    // customer_activity / customer_comment. The returned page's title/body are\n    // still decrypted for display further below.\n    const searchTerm = `%${escapeLikePattern(query.search)}%`\n    q = q.where(sql<boolean>`coalesce(title, '') ilike ${searchTerm} or coalesce(body, '') ilike ${searchTerm}`)\n  }\n  if (query.recurrenceMasters === 'true') {\n    q = q.where('recurrence_rule', 'is not', null)\n    if (query.from) {\n      q = q.where(sql<boolean>`recurrence_end is null or recurrence_end >= ${query.from}`)\n    }\n    if (query.to) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)\n    }\n  } else {\n    if (query.from) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`)\n    }\n    if (query.to) {\n      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)\n    }\n  }\n  return q\n}\n\nasync function resolveUserFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return undefined\n    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\nasync function buildEnricherContext(\n  container: { resolve: (name: string) => unknown },\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,\n  organizationId: string | null,\n  precomputedUserFeatures?: { userId: string; features: string[] | undefined },\n): Promise<EnricherContext> {\n  const userId =\n    (typeof auth.sub === 'string' && auth.sub.trim().length > 0\n      ? auth.sub\n      : typeof auth.userId === 'string' && auth.userId.trim().length > 0\n        ? auth.userId\n        : typeof auth.keyId === 'string' && auth.keyId.trim().length > 0\n          ? auth.keyId\n          : 'system')\n\n  // Reuse features already resolved for this same user (the GET handler resolves\n  // them once for the visibility filter) to avoid a second RBAC lookup per request.\n  const userFeatures =\n    precomputedUserFeatures && precomputedUserFeatures.userId === userId\n      ? precomputedUserFeatures.features\n      : await resolveUserFeatures(container, userId, auth.tenantId ?? null, organizationId)\n\n  return {\n    organizationId: organizationId ?? '',\n    tenantId: auth.tenantId ?? '',\n    userId,\n    em: container.resolve('em'),\n    container,\n    userFeatures,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const queryUrl = new URL(req.url)\n    const query = listSchema.parse(Object.fromEntries(queryUrl.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, {\n        error: translate('customers.errors.unauthorized', 'Unauthorized'),\n      })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const { organizationIds, rbacOrganizationId: selectedOrganizationId } = resolveOrganizationScopeFilter(scope, auth)\n\n    const requestedSortField = query.sortField ?? 'scheduledAt'\n    const sortConfig = interactionSortConfig[requestedSortField]\n    const sortDir = query.sortDir ?? sortConfig.defaultDir\n    const sortSql = buildSortSql(requestedSortField, sortDir)\n    const cursor = decodeCursor(query.cursor, sortConfig.type)\n    if (query.cursor && !cursor) {\n      throw new CrudHttpError(400, {\n        error: translate('customers.interactions.cursor.invalid', 'Invalid cursor'),\n      })\n    }\n    if (organizationIds?.length === 0) {\n      return NextResponse.json({ items: [] })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const db = em.getKysely<any>() as any\n\n    // \u2500\u2500 Email visibility filter (2026-05-27) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // Non-email interactions pass through; email rows with visibility='private'\n    // are filtered out unless the caller is the author or has admin bypass.\n    // API-key callers have no user identity (`auth.sub` undefined): resolve the\n    // viewer to null so they never gain the author bypass and only see shared\n    // emails (fail-closed). Mirrors counts/people/activities routes.\n    const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)\n    // Conversation shares that widen this caller's email access. Unscoped surface,\n    // so this is the capped variant (see SHARE_ARM_MAX).\n    const emailShareScope = {\n      tenantId: auth.tenantId as string,\n      organizationId: selectedOrganizationId,\n    }\n    const [emailShareGrants, emailSharedChannelIds] = await Promise.all([\n      listGrantsForViewer(em, emailShareScope, viewerUserId),\n      listSharedChannelIds(em, emailShareScope, viewerUserId),\n    ])\n    const encryptionService = resolveTenantEncryptionService(em)\n    // Encrypted sort columns can't use SQL keyset ordering on ciphertext, so an\n    // encrypted sort field takes a bounded candidate-scan + in-memory-sort path\n    // instead of the SQL path below. Resolved alongside the independent\n    // visibility-feature lookup rather than after it.\n    const [callerUserFeatures, encryptedSortFields] = await Promise.all([\n      viewerUserId\n        ? resolveUserFeatures(container, viewerUserId, auth.tenantId ?? null, selectedOrganizationId)\n        : Promise.resolve(undefined),\n      resolveEncryptedSortFields(\n        encryptionService,\n        CUSTOMER_INTERACTION_ENTITY_ID,\n        [sortConfig.column],\n        auth.tenantId,\n        selectedOrganizationId,\n      ),\n    ])\n    const sortFieldIsEncrypted = encryptedSortFields.has(sortConfig.column)\n\n    let pageRows: InteractionListRow[]\n    let hasMore: boolean\n\n    if (sortFieldIsEncrypted) {\n      let candidateQuery = applyInteractionListFilters(\n        db.selectFrom('customer_interactions').select(['id', sortConfig.column]),\n        { tenantId: auth.tenantId, organizationIds, query },\n      )\n      candidateQuery = applyEmailVisibilityFilter(candidateQuery as any, {\n        currentUserId: viewerUserId,\n        userFeatures: callerUserFeatures,\n        sharedConversations: emailShareGrants,\n        sharedChannelIds: emailSharedChannelIds,\n      })\n      const cap = resolveEncryptedSortMaxRows()\n      if (cap !== null) {\n        candidateQuery = candidateQuery.limit(cap).orderBy('id', 'asc')\n      }\n      const candidateRows = await candidateQuery.execute() as Array<{ id: string } & Record<string, unknown>>\n      if (cap !== null && candidateRows.length >= cap) {\n        logger.warn('Encrypted sort candidate scan hit OM_ENCRYPTED_SORT_MAX_ROWS cap; results may be incomplete', {\n          component: 'interactions.GET',\n          cap,\n          sortField: sortConfig.column,\n          tenantId: auth.tenantId,\n        })\n      }\n\n      const decryptPayload = encryptionService?.decryptEntityPayload?.bind(encryptionService)\n      const { pageIds, hasMore: encryptedHasMore } = await resolveEncryptedSortPage({\n        candidates: candidateRows,\n        decryptRow: async (row) => {\n          if (!decryptPayload) return row\n          try {\n            const decrypted = await decryptPayload(CUSTOMER_INTERACTION_ENTITY_ID, row, auth.tenantId, selectedOrganizationId)\n            return { ...row, ...decrypted }\n          } catch (err) {\n            logger.error('error decrypting sort candidate', { component: 'interactions.GET', err })\n            return row\n          }\n        },\n        sortField: sortConfig.column,\n        sortDir,\n        cursorId: cursor?.id ?? null,\n        limit: query.limit,\n      })\n      hasMore = encryptedHasMore\n\n      if (pageIds.length === 0) {\n        pageRows = []\n      } else {\n        let pageQuery = applyInteractionListFilters(\n          db.selectFrom('customer_interactions').select([...INTERACTION_LIST_COLUMNS, sql`${sql.raw(sortSql)}`.as('__sort_value')]),\n          { tenantId: auth.tenantId, organizationIds, query },\n        )\n        pageQuery = applyEmailVisibilityFilter(pageQuery as any, {\n          currentUserId: viewerUserId,\n          userFeatures: callerUserFeatures,\n          sharedConversations: emailShareGrants,\n          sharedChannelIds: emailSharedChannelIds,\n        })\n        pageQuery = pageQuery.where('id', 'in', pageIds)\n        const rawPageRows = await pageQuery.execute() as InteractionListRow[]\n        const byId = new Map(rawPageRows.map((row) => [row.id, row]))\n        pageRows = pageIds\n          .map((id) => byId.get(id))\n          .filter((row): row is InteractionListRow => row != null)\n      }\n    } else {\n      let rowsQuery = applyInteractionListFilters(\n        db\n          .selectFrom('customer_interactions')\n          .select([...INTERACTION_LIST_COLUMNS, sql`${sql.raw(sortSql)}`.as('__sort_value')])\n          .limit(query.limit + 1),\n        { tenantId: auth.tenantId, organizationIds, query },\n      )\n\n      if (cursor) {\n        const op = sortDir === 'asc' ? '>' : '<'\n        const opRaw = sql.raw(op)\n        const sortRaw = sql.raw(sortSql)\n        rowsQuery = rowsQuery.where((eb: any) => eb.or([\n          sql<boolean>`${sortRaw} ${opRaw} ${cursor.sortValue}`,\n          eb.and([\n            sql<boolean>`${sortRaw} = ${cursor.sortValue}`,\n            eb('id', op, cursor.id),\n          ]),\n        ]))\n      }\n\n      rowsQuery = applyEmailVisibilityFilter(rowsQuery as any, {\n        currentUserId: viewerUserId,\n        userFeatures: callerUserFeatures,\n        sharedConversations: emailShareGrants,\n        sharedChannelIds: emailSharedChannelIds,\n      })\n\n      rowsQuery = rowsQuery.orderBy(sql`${sql.raw(sortSql)} ${sql.raw(sortDir)}`).orderBy('id', sortDir)\n\n      const rows = await rowsQuery.execute() as InteractionListRow[]\n      pageRows = rows.slice(0, query.limit)\n      hasMore = rows.length > query.limit\n    }\n\n    const authorIds = Array.from(\n      new Set(\n        pageRows\n          .map((row) => (typeof row.author_user_id === 'string' ? row.author_user_id : null))\n          .filter((value): value is string => !!value),\n      ),\n    )\n    const dealIds = Array.from(\n      new Set(\n        pageRows\n          .map((row) => (typeof row.deal_id === 'string' ? row.deal_id : null))\n          .filter((value): value is string => !!value),\n      ),\n    )\n    const interactionIds = pageRows.map((row) => row.id)\n    // A page can span the selected organization plus its descendants\n    // (organizationScope.ts expands a concrete selection that way), and\n    // encryption maps are resolved per organization with first-match-wins \u2014\n    // an org-specific map replaces rather than merges with the tenant-wide\n    // one. Resolving a single field set from `selectedOrganizationId` and\n    // applying it to every row therefore missed descendant-org fields the\n    // row's own map covers (#5945 follow-up). Each row's own\n    // `organization_id` is resolved instead, one lookup per distinct\n    // organization on the page \u2014 `getEncryptedFieldNames` memoizes per\n    // (entity, tenant, organization), so this adds no query for the common\n    // single-organization case.\n    const pageOrganizationIds = Array.from(\n      new Set(pageRows.map((row) => row.organization_id).filter((value): value is string => !!value)),\n    )\n\n    const [users, deals, customFieldValues, interactionRecords, encryptedFieldsByOrganization] = await Promise.all([\n      authorIds.length > 0 ? findWithDecryption(em, User, { id: { $in: authorIds } }, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId }) : Promise.resolve([]),\n      dealIds.length > 0 ? findWithDecryption(em, CustomerDeal, { id: { $in: dealIds } }, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId }) : Promise.resolve([]),\n      interactionIds.length > 0\n        ? loadCustomFieldValues({\n            em,\n            entityId: CUSTOMER_INTERACTION_ENTITY_ID,\n            recordIds: interactionIds,\n            tenantIdByRecord: Object.fromEntries(pageRows.map((row) => [row.id, row.tenant_id])),\n            organizationIdByRecord: Object.fromEntries(pageRows.map((row) => [row.id, row.organization_id])),\n            tenantFallbacks: [auth.tenantId].filter((value): value is string => !!value),\n          })\n        : Promise.resolve<Record<string, Record<string, unknown>>>({}),\n      interactionIds.length > 0\n        ? findWithDecryption(em, CustomerInteraction, { id: { $in: interactionIds } } as never, undefined, { tenantId: auth.tenantId, organizationId: selectedOrganizationId })\n        : Promise.resolve([]),\n      (async () => {\n        const byOrganization = new Map<string, readonly string[]>()\n        if (interactionIds.length === 0 || !encryptionService?.getEncryptedFieldNames || pageOrganizationIds.length === 0) {\n          return byOrganization\n        }\n        await Promise.all(pageOrganizationIds.map(async (organizationId) => {\n          const fields = await encryptionService.getEncryptedFieldNames(CUSTOMER_INTERACTION_ENTITY_ID, auth.tenantId, organizationId)\n          byOrganization.set(organizationId, fields)\n        }))\n        return byOrganization\n      })(),\n    ])\n\n    const userMap = new Map(\n      users.map((user) => [\n        user.id,\n        {\n          name: user.name ?? null,\n          email: user.email ?? null,\n        },\n      ]),\n    )\n    const dealMap = new Map(\n      deals.map((deal) => [deal.id, deal.title]),\n    )\n    // The kysely rows above carry raw column values, so every field the entity's\n    // encryption map covers arrives as ciphertext. findWithDecryption already\n    // returned those fields in plaintext, so the response takes them from the\n    // decrypted records. The covered set is read from each row's own\n    // organization's resolved map rather than hard-coded or shared across the\n    // page, so extending the map \u2014 or a page spanning several organizations \u2014\n    // cannot leave a field passing through as ciphertext (#5945).\n    const interactionRecordMap = new Map<string, CustomerInteraction>(\n      (interactionRecords as CustomerInteraction[]).map((record) => [record.id, record]),\n    )\n\n    const baseItems = pageRows.map((row) => applyDecryptedFields({\n      id: row.id,\n      entityId: row.entity_id,\n      dealId: row.deal_id ?? null,\n      interactionType: row.interaction_type,\n      title: row.title ?? null,\n      body: row.body ?? null,\n      status: row.status,\n      scheduledAt: toIsoString(row.scheduled_at),\n      occurredAt: toIsoString(row.occurred_at),\n      priority: row.priority ?? null,\n      authorUserId: row.author_user_id ?? null,\n      ownerUserId: row.owner_user_id ?? null,\n      externalMessageId: row.external_message_id ?? null,\n      appearanceIcon: row.appearance_icon ?? null,\n      appearanceColor: row.appearance_color ?? null,\n      source: row.source ?? null,\n      duration: row.duration_minutes ?? null,\n      durationMinutes: row.duration_minutes ?? null,\n      location: row.location ?? null,\n      allDay: row.all_day ?? null,\n      recurrenceRule: row.recurrence_rule ?? null,\n      recurrenceEnd: toIsoString(row.recurrence_end),\n      participants: row.participants ?? null,\n      reminderMinutes: row.reminder_minutes ?? null,\n      visibility: row.visibility ?? null,\n      channelId: row.channel_id ?? null,\n      linkedEntities: row.linked_entities ?? null,\n      guestPermissions: row.guest_permissions ?? null,\n      pinned: row.pinned ?? false,\n      organizationId: row.organization_id,\n      tenantId: row.tenant_id,\n      createdAt: toIsoString(row.created_at) ?? new Date().toISOString(),\n      updatedAt: toIsoString(row.updated_at) ?? new Date().toISOString(),\n      authorName: row.author_user_id ? userMap.get(row.author_user_id)?.name ?? null : null,\n      authorEmail: row.author_user_id ? userMap.get(row.author_user_id)?.email ?? null : null,\n      dealTitle: row.deal_id ? dealMap.get(row.deal_id) ?? null : null,\n      customValues: normalizeCustomFieldResponse(customFieldValues[row.id]) ?? null,\n    }, interactionRecordMap.get(row.id), encryptedFieldsByOrganization.get(row.organization_id) ?? []))\n\n    const enricherContext = await buildEnricherContext(\n      container,\n      auth,\n      selectedOrganizationId,\n      viewerUserId ? { userId: viewerUserId, features: callerUserFeatures } : undefined,\n    )\n    const enriched = await applyResponseEnrichers(baseItems, 'customers.interaction', enricherContext)\n\n    let nextCursor: string | undefined\n    if (hasMore && pageRows.length > 0) {\n      const last = pageRows[pageRows.length - 1]\n      nextCursor = encodeCursor({\n        id: last.id,\n        sortValue: normalizeCursorValue(last.__sort_value, sortConfig.type),\n      })\n    }\n\n    return NextResponse.json({\n      items: enriched.items,\n      nextCursor,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: 'Validation failed', details: err.issues },\n        { status: 400 },\n      )\n    }\n    logger.error('customers.interactions.get failed', { err })\n    const { translate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: translate('customers.interactions.load.error', 'Failed to load interactions.') },\n      { status: 500 },\n    )\n  }\n}\n\nconst interactionListItemSchema = z\n  .object({\n    id: z.string().uuid(),\n    entityId: z.string().uuid().nullable(),\n    dealId: z.string().uuid().nullable(),\n    interactionType: z.string(),\n    title: z.string().nullable(),\n    body: z.string().nullable(),\n    status: z.string(),\n    scheduledAt: z.string().nullable(),\n    occurredAt: z.string().nullable(),\n    priority: z.number().nullable(),\n    authorUserId: z.string().uuid().nullable(),\n    ownerUserId: z.string().uuid().nullable(),\n    externalMessageId: z.string().uuid().nullable().optional(),\n    appearanceIcon: z.string().nullable().optional(),\n    appearanceColor: z.string().nullable().optional(),\n    source: z.string().nullable().optional(),\n    duration: z.number().nullable().optional(),\n    durationMinutes: z.number().nullable().optional(),\n    location: z.string().nullable().optional(),\n    allDay: z.boolean().nullable().optional(),\n    recurrenceRule: z.string().nullable().optional(),\n    recurrenceEnd: z.string().nullable().optional(),\n    participants: z.array(\n      z.object({\n        userId: z\n          .string()\n          .uuid()\n          .optional()\n          .describe(\n            'Absent for an external guest, who has no person/customer/staff record and is identified by email instead. Identify a participant by userId when present, otherwise by its normalized email.',\n          ),\n        name: z.string().optional(),\n        email: z.string().optional(),\n        status: z.string().optional(),\n      }),\n    ).nullable().optional(),\n    reminderMinutes: z.number().nullable().optional(),\n    visibility: z.string().nullable().optional(),\n    linkedEntities: z.array(\n      z.object({\n        id: z.string().uuid(),\n        type: z.string(),\n        label: z.string(),\n      }),\n    ).nullable().optional(),\n    guestPermissions: z\n      .object({\n        canInviteOthers: z.boolean().optional(),\n        canModify: z.boolean().optional(),\n        canSeeList: z.boolean().optional(),\n      })\n      .nullable()\n      .optional(),\n    organizationId: z.string().uuid().nullable().optional(),\n    tenantId: z.string().uuid().nullable().optional(),\n    createdAt: z.string().nullable(),\n    updatedAt: z.string().nullable(),\n    authorName: z.string().nullable().optional(),\n    authorEmail: z.string().nullable().optional(),\n    dealTitle: z.string().nullable().optional(),\n    customValues: z.record(z.string(), z.unknown()).nullable().optional(),\n    _integrations: z.record(z.string(), z.unknown()).optional(),\n  })\n  .passthrough()\n\nconst interactionListResponseSchema = z.object({\n  items: z.array(interactionListItemSchema),\n  nextCursor: z.string().optional(),\n})\n\nconst interactionCreateResponseSchema = z.object({\n  id: z.string().uuid().nullable(),\n})\n\nexport const openApi = createCustomersCrudOpenApi({\n  resourceName: 'Interaction',\n  querySchema: listSchema,\n  listResponseSchema: interactionListResponseSchema,\n  create: {\n    schema: interactionCreateSchema,\n    responseSchema: interactionCreateResponseSchema,\n    description: 'Creates a new interaction linked to a customer entity or deal.',\n  },\n  update: {\n    schema: interactionUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates fields for an existing interaction.',\n  },\n  del: {\n    schema: z.object({ id: z.string().uuid() }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Soft-deletes an interaction identified by `id`. Accepts id via body or query string.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAW;AACpB,SAAS,qBAAqB;AAC9B,SAAS,eAAe,uBAAuB;AAC/C,SAAS,6BAA6B;AACtC,SAAS,oCAAoC;AAC7C,SAAS,8BAA8B;AAEvC,SAAS,0BAA0B;AACnC,SAAS,sCAAsC;AAC/C,SAAS,4BAA4B,mCAAmC;AACxE,SAAS,yBAAyB;AAClC,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,2BAA2B;AACpC,SAAS,cAAc,2BAA2B;AAClD,SAAS,YAAY;AACrB,SAAS,yBAAyB,+BAA+B;AACjE,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,wCAAwC;AAEjD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,6BAA6B,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAEM,MAAM,aAAa,EACvB,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC1C,MAAM,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC/B,IAAI,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EAC7B,mBAAmB,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EACtD,QAAQ,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,EAC3C,WAAW,2BAA2B,SAAS;AAAA,EAC/C,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AAEf,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC3E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC9E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAAA,EAC7E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAClF;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,WAAW,EAAE,UAAU,wBAAwB;AAAA,EAC/C,SAAS;AAAA,IACP,YAAY;AAAA,EACd;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,eAAO,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAAA,MACnF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,iBAAiB,QAAQ,MAAM,KAAK;AAAA,MAC7E,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,yBAAyB,OAAO,CAAC,GAAG,KAAK,SAAS;AAKzF,cAAM,WAAW,IAAI,MAAM,YAAY;AACvC,YAAI,OAAO,OAAO,OAAO,YAAY,UAAU;AAC7C,cAAI;AACF,kBAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,kBAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,kBAAM,iBAAwC;AAAA,cAC5C,WAAW,IAAI;AAAA,cACf,MAAM,IAAI,QAAQ;AAAA,cAClB,mBAAmB,IAAI,qBAAqB;AAAA,cAC5C,wBAAwB,IAAI,0BAA0B;AAAA,cACtD,iBAAiB,IAAI,mBAAmB;AAAA,cACxC,SAAS,IAAI;AAAA,YACf;AACA,kBAAM,iCAAiC,IAAI,YAAY,gBAAgB,OAAO,IAAI,QAAQ;AAAA,UAC5F,SAAS,KAAK;AAGZ,mBAAO,KAAK,oCAAoC,EAAE,WAAW,oBAAoB,IAAI,OAAO,IAAI,IAAI,CAAC;AAAA,UACvG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KACJ,QAAQ,MAAM,MACd,QAAQ,MACR,QAAQ,OAAO,OACd,IAAI,UAAU,IAAI,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,IAAI,IAAI;AACnE,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,yCAAyC,4BAA4B;AAAA,UACxF,CAAC;AAAA,QACH;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAED,MAAM,EAAE,MAAM,KAAK,OAAO,IAAI;AAkD9B,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,wBAAwB;AAAA,EAC5B,aAAa,EAAE,QAAQ,gBAAgB,MAAM,QAAiB,YAAY,MAAe;AAAA,EACzF,YAAY,EAAE,QAAQ,eAAe,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACxF,WAAW,EAAE,QAAQ,cAAc,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACtF,WAAW,EAAE,QAAQ,cAAc,MAAM,QAAiB,YAAY,OAAgB;AAAA,EACtF,QAAQ,EAAE,QAAQ,UAAU,MAAM,QAAiB,YAAY,MAAe;AAAA,EAC9E,UAAU,EAAE,QAAQ,YAAY,MAAM,UAAmB,YAAY,OAAgB;AAAA,EACrF,iBAAiB,EAAE,QAAQ,oBAAoB,MAAM,QAAiB,YAAY,MAAe;AAAA,EACjG,OAAO,EAAE,QAAQ,SAAS,MAAM,QAAiB,YAAY,MAAe;AAC9E;AAEA,SAAS,YAAY,OAA+B;AAClD,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,WAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,OAAO,MAAM,YAAY;AAAA,EAClE;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,UAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,WAAO,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,UAAU,OAAO,YAAY;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,qBACP,OACA,MACwB;AACxB,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,SAAS,UAAU;AACrB,QAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,EAAG,QAAO;AAChE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,MAAM,MAAM,IAAI,OAAO;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS,QAAQ;AACnB,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,aAAa,SAAgC;AACpD,SAAO,OAAO,KAAK,KAAK,UAAU,OAAO,GAAG,MAAM,EAAE,SAAS,QAAQ;AACvE;AAEA,SAAS,aAAa,OAA2B,MAAwD;AACvG,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,MAAM;AAC5D,UAAM,SAAS,aAAa,MAAM,KAAK,MAAM,OAAO,CAAC;AACrD,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX,WAAW,qBAAqB,OAAO,WAAW,IAAI;AAAA,IACxD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aACP,WACA,SACQ;AACR,QAAM,SAAS,sBAAsB,SAAS;AAC9C,MAAI,OAAO,SAAS,QAAQ;AAC1B,UAAMA,YACJ,YAAY,QACR,wDACA;AACN,WAAO,YAAY,OAAO,MAAM,KAAKA,SAAQ;AAAA,EAC/C;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAMA,YAAW,YAAY,QAAQ,eAAe;AACpD,WAAO,YAAY,OAAO,MAAM,KAAKA,SAAQ;AAAA,EAC/C;AACA,QAAM,WAAW,YAAY,QAAQ,iBAAiB;AACtD,SAAO,YAAY,OAAO,MAAM,KAAK,QAAQ;AAC/C;AAEA,MAAM,2BAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,SAAS,4BACP,WACA,QAKK;AACL,MAAI,IAAI,UAAU,MAAM,cAAc,MAAM,IAAI,EAAE,MAAM,aAAa,KAAK,OAAO,QAAQ;AACzF,MAAI,OAAO,oBAAoB,OAAW,KAAI,EAAE,MAAM,mBAAmB,MAAM,OAAO,eAAe;AACrG,QAAM,EAAE,MAAM,IAAI;AAClB,MAAI,MAAM,SAAU,KAAI,EAAE,MAAM,aAAa,KAAK,MAAM,QAAQ;AAChE,MAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,WAAW,KAAK,MAAM,MAAM;AAC1D,MAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,MAAM;AACzD,MAAI,MAAM,gBAAiB,KAAI,EAAE,MAAM,oBAAoB,KAAK,MAAM,eAAe;AACrF,MAAI,MAAM,MAAM;AACd,UAAM,QAAQ,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACvE,QAAI,MAAM,SAAS,EAAG,KAAI,EAAE,MAAM,oBAAoB,MAAM,KAAK;AAAA,EACnE;AACA,MAAI,MAAM,WAAW,QAAQ;AAC3B,QAAI,EAAE,MAAM,UAAU,KAAK,IAAI;AAAA,EACjC,WAAW,MAAM,WAAW,SAAS;AACnC,QAAI,EAAE,MAAM,UAAU,KAAK,KAAK;AAAA,EAClC;AACA,MAAI,MAAM,uBAAwB,KAAI,EAAE,MAAM,oBAAoB,MAAM,MAAM,sBAAsB;AACpG,MAAI,MAAM,QAAQ;AAOhB,UAAM,aAAa,IAAI,kBAAkB,MAAM,MAAM,CAAC;AACtD,QAAI,EAAE,MAAM,gCAAyC,UAAU,gCAAgC,UAAU,EAAE;AAAA,EAC7G;AACA,MAAI,MAAM,sBAAsB,QAAQ;AACtC,QAAI,EAAE,MAAM,mBAAmB,UAAU,IAAI;AAC7C,QAAI,MAAM,MAAM;AACd,UAAI,EAAE,MAAM,kDAA2D,MAAM,IAAI,EAAE;AAAA,IACrF;AACA,QAAI,MAAM,IAAI;AACZ,UAAI,EAAE,MAAM,yDAAkE,MAAM,EAAE,EAAE;AAAA,IAC1F;AAAA,EACF,OAAO;AACL,QAAI,MAAM,MAAM;AACd,UAAI,EAAE,MAAM,yDAAkE,MAAM,IAAI,EAAE;AAAA,IAC5F;AACA,QAAI,MAAM,IAAI;AACZ,UAAI,EAAE,MAAM,yDAAkE,MAAM,EAAE,EAAE;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,oBACb,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAO,MAAM,KAAK,mBAAmB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,qBACb,WACA,MACA,gBACA,yBAC0B;AAC1B,QAAM,SACH,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,IACtD,KAAK,MACL,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,IAC7D,KAAK,SACL,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,IAC3D,KAAK,QACL;AAIV,QAAM,eACJ,2BAA2B,wBAAwB,WAAW,SAC1D,wBAAwB,WACxB,MAAM,oBAAoB,WAAW,QAAQ,KAAK,YAAY,MAAM,cAAc;AAExF,SAAO;AAAA,IACL,gBAAgB,kBAAkB;AAAA,IAClC,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,IACA,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,WAAW,IAAI,IAAI,IAAI,GAAG;AAChC,UAAM,QAAQ,WAAW,MAAM,OAAO,YAAY,SAAS,YAAY,CAAC;AACxE,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,iCAAiC,cAAc;AAAA,MAClE,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,EAAE,iBAAiB,oBAAoB,uBAAuB,IAAI,+BAA+B,OAAO,IAAI;AAElH,UAAM,qBAAqB,MAAM,aAAa;AAC9C,UAAM,aAAa,sBAAsB,kBAAkB;AAC3D,UAAM,UAAU,MAAM,WAAW,WAAW;AAC5C,UAAM,UAAU,aAAa,oBAAoB,OAAO;AACxD,UAAM,SAAS,aAAa,MAAM,QAAQ,WAAW,IAAI;AACzD,QAAI,MAAM,UAAU,CAAC,QAAQ;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,yCAAyC,gBAAgB;AAAA,MAC5E,CAAC;AAAA,IACH;AACA,QAAI,iBAAiB,WAAW,GAAG;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAAA,IACxC;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,KAAK,GAAG,UAAe;AAQ7B,UAAM,eAAe,KAAK,WAAW,OAAQ,KAAK,OAAO;AAGzD,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,gBAAgB;AAAA,IAClB;AACA,UAAM,CAAC,kBAAkB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,oBAAoB,IAAI,iBAAiB,YAAY;AAAA,MACrD,qBAAqB,IAAI,iBAAiB,YAAY;AAAA,IACxD,CAAC;AACD,UAAM,oBAAoB,+BAA+B,EAAE;AAK3D,UAAM,CAAC,oBAAoB,mBAAmB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,eACI,oBAAoB,WAAW,cAAc,KAAK,YAAY,MAAM,sBAAsB,IAC1F,QAAQ,QAAQ,MAAS;AAAA,MAC7B;AAAA,QACE;AAAA,QACA;AAAA,QACA,CAAC,WAAW,MAAM;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,uBAAuB,oBAAoB,IAAI,WAAW,MAAM;AAEtE,QAAI;AACJ,QAAI;AAEJ,QAAI,sBAAsB;AACxB,UAAI,iBAAiB;AAAA,QACnB,GAAG,WAAW,uBAAuB,EAAE,OAAO,CAAC,MAAM,WAAW,MAAM,CAAC;AAAA,QACvE,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,MACpD;AACA,uBAAiB,2BAA2B,gBAAuB;AAAA,QACjE,eAAe;AAAA,QACf,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,MACpB,CAAC;AACD,YAAM,MAAM,4BAA4B;AACxC,UAAI,QAAQ,MAAM;AAChB,yBAAiB,eAAe,MAAM,GAAG,EAAE,QAAQ,MAAM,KAAK;AAAA,MAChE;AACA,YAAM,gBAAgB,MAAM,eAAe,QAAQ;AACnD,UAAI,QAAQ,QAAQ,cAAc,UAAU,KAAK;AAC/C,eAAO,KAAK,+FAA+F;AAAA,UACzG,WAAW;AAAA,UACX;AAAA,UACA,WAAW,WAAW;AAAA,UACtB,UAAU,KAAK;AAAA,QACjB,CAAC;AAAA,MACH;AAEA,YAAM,iBAAiB,mBAAmB,sBAAsB,KAAK,iBAAiB;AACtF,YAAM,EAAE,SAAS,SAAS,iBAAiB,IAAI,MAAM,yBAAyB;AAAA,QAC5E,YAAY;AAAA,QACZ,YAAY,OAAO,QAAQ;AACzB,cAAI,CAAC,eAAgB,QAAO;AAC5B,cAAI;AACF,kBAAM,YAAY,MAAM,eAAe,gCAAgC,KAAK,KAAK,UAAU,sBAAsB;AACjH,mBAAO,EAAE,GAAG,KAAK,GAAG,UAAU;AAAA,UAChC,SAAS,KAAK;AACZ,mBAAO,MAAM,mCAAmC,EAAE,WAAW,oBAAoB,IAAI,CAAC;AACtF,mBAAO;AAAA,UACT;AAAA,QACF;AAAA,QACA,WAAW,WAAW;AAAA,QACtB;AAAA,QACA,UAAU,QAAQ,MAAM;AAAA,QACxB,OAAO,MAAM;AAAA,MACf,CAAC;AACD,gBAAU;AAEV,UAAI,QAAQ,WAAW,GAAG;AACxB,mBAAW,CAAC;AAAA,MACd,OAAO;AACL,YAAI,YAAY;AAAA,UACd,GAAG,WAAW,uBAAuB,EAAE,OAAO,CAAC,GAAG,0BAA0B,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;AAAA,UACxH,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,QACpD;AACA,oBAAY,2BAA2B,WAAkB;AAAA,UACvD,eAAe;AAAA,UACf,cAAc;AAAA,UACd,qBAAqB;AAAA,UACrB,kBAAkB;AAAA,QACpB,CAAC;AACD,oBAAY,UAAU,MAAM,MAAM,MAAM,OAAO;AAC/C,cAAM,cAAc,MAAM,UAAU,QAAQ;AAC5C,cAAM,OAAO,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AAC5D,mBAAW,QACR,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,EACxB,OAAO,CAAC,QAAmC,OAAO,IAAI;AAAA,MAC3D;AAAA,IACF,OAAO;AACL,UAAI,YAAY;AAAA,QACd,GACG,WAAW,uBAAuB,EAClC,OAAO,CAAC,GAAG,0BAA0B,MAAM,IAAI,IAAI,OAAO,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,EACjF,MAAM,MAAM,QAAQ,CAAC;AAAA,QACxB,EAAE,UAAU,KAAK,UAAU,iBAAiB,MAAM;AAAA,MACpD;AAEA,UAAI,QAAQ;AACV,cAAM,KAAK,YAAY,QAAQ,MAAM;AACrC,cAAM,QAAQ,IAAI,IAAI,EAAE;AACxB,cAAM,UAAU,IAAI,IAAI,OAAO;AAC/B,oBAAY,UAAU,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UAC7C,MAAe,OAAO,IAAI,KAAK,IAAI,OAAO,SAAS;AAAA,UACnD,GAAG,IAAI;AAAA,YACL,MAAe,OAAO,MAAM,OAAO,SAAS;AAAA,YAC5C,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,UACxB,CAAC;AAAA,QACH,CAAC,CAAC;AAAA,MACJ;AAEA,kBAAY,2BAA2B,WAAkB;AAAA,QACvD,eAAe;AAAA,QACf,cAAc;AAAA,QACd,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,MACpB,CAAC;AAED,kBAAY,UAAU,QAAQ,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,QAAQ,MAAM,OAAO;AAEjG,YAAM,OAAO,MAAM,UAAU,QAAQ;AACrC,iBAAW,KAAK,MAAM,GAAG,MAAM,KAAK;AACpC,gBAAU,KAAK,SAAS,MAAM;AAAA,IAChC;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB,IAAI;AAAA,QACF,SACG,IAAI,CAAC,QAAS,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB,IAAK,EACjF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,SACG,IAAI,CAAC,QAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAU,IAAK,EACnE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC/C;AAAA,IACF;AACA,UAAM,iBAAiB,SAAS,IAAI,CAAC,QAAQ,IAAI,EAAE;AAYnD,UAAM,sBAAsB,MAAM;AAAA,MAChC,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK,CAAC;AAAA,IAChG;AAEA,UAAM,CAAC,OAAO,OAAO,mBAAmB,oBAAoB,6BAA6B,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7G,UAAU,SAAS,IAAI,mBAAmB,IAAI,MAAM,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACpL,QAAQ,SAAS,IAAI,mBAAmB,IAAI,cAAc,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IAAI,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACxL,eAAe,SAAS,IACpB,sBAAsB;AAAA,QACpB;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,QACX,kBAAkB,OAAO,YAAY,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC;AAAA,QACnF,wBAAwB,OAAO,YAAY,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,CAAC;AAAA,QAC/F,iBAAiB,CAAC,KAAK,QAAQ,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,MAC7E,CAAC,IACD,QAAQ,QAAiD,CAAC,CAAC;AAAA,MAC/D,eAAe,SAAS,IACpB,mBAAmB,IAAI,qBAAqB,EAAE,IAAI,EAAE,KAAK,eAAe,EAAE,GAAY,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB,CAAC,IACpK,QAAQ,QAAQ,CAAC,CAAC;AAAA,OACrB,YAAY;AACX,cAAM,iBAAiB,oBAAI,IAA+B;AAC1D,YAAI,eAAe,WAAW,KAAK,CAAC,mBAAmB,0BAA0B,oBAAoB,WAAW,GAAG;AACjH,iBAAO;AAAA,QACT;AACA,cAAM,QAAQ,IAAI,oBAAoB,IAAI,OAAO,mBAAmB;AAClE,gBAAM,SAAS,MAAM,kBAAkB,uBAAuB,gCAAgC,KAAK,UAAU,cAAc;AAC3H,yBAAe,IAAI,gBAAgB,MAAM;AAAA,QAC3C,CAAC,CAAC;AACF,eAAO;AAAA,MACT,GAAG;AAAA,IACL,CAAC;AAED,UAAM,UAAU,IAAI;AAAA,MAClB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,MAAM,KAAK,QAAQ;AAAA,UACnB,OAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,UAAU,IAAI;AAAA,MAClB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC;AAAA,IAC3C;AAQA,UAAM,uBAAuB,IAAI;AAAA,MAC9B,mBAA6C,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC;AAAA,IACnF;AAEA,UAAM,YAAY,SAAS,IAAI,CAAC,QAAQ,qBAAqB;AAAA,MAC3D,IAAI,IAAI;AAAA,MACR,UAAU,IAAI;AAAA,MACd,QAAQ,IAAI,WAAW;AAAA,MACvB,iBAAiB,IAAI;AAAA,MACrB,OAAO,IAAI,SAAS;AAAA,MACpB,MAAM,IAAI,QAAQ;AAAA,MAClB,QAAQ,IAAI;AAAA,MACZ,aAAa,YAAY,IAAI,YAAY;AAAA,MACzC,YAAY,YAAY,IAAI,WAAW;AAAA,MACvC,UAAU,IAAI,YAAY;AAAA,MAC1B,cAAc,IAAI,kBAAkB;AAAA,MACpC,aAAa,IAAI,iBAAiB;AAAA,MAClC,mBAAmB,IAAI,uBAAuB;AAAA,MAC9C,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,QAAQ,IAAI,UAAU;AAAA,MACtB,UAAU,IAAI,oBAAoB;AAAA,MAClC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,UAAU,IAAI,YAAY;AAAA,MAC1B,QAAQ,IAAI,WAAW;AAAA,MACvB,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,eAAe,YAAY,IAAI,cAAc;AAAA,MAC7C,cAAc,IAAI,gBAAgB;AAAA,MAClC,iBAAiB,IAAI,oBAAoB;AAAA,MACzC,YAAY,IAAI,cAAc;AAAA,MAC9B,WAAW,IAAI,cAAc;AAAA,MAC7B,gBAAgB,IAAI,mBAAmB;AAAA,MACvC,kBAAkB,IAAI,qBAAqB;AAAA,MAC3C,QAAQ,IAAI,UAAU;AAAA,MACtB,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,WAAW,YAAY,IAAI,UAAU,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MACjE,WAAW,YAAY,IAAI,UAAU,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MACjE,YAAY,IAAI,iBAAiB,QAAQ,IAAI,IAAI,cAAc,GAAG,QAAQ,OAAO;AAAA,MACjF,aAAa,IAAI,iBAAiB,QAAQ,IAAI,IAAI,cAAc,GAAG,SAAS,OAAO;AAAA,MACnF,WAAW,IAAI,UAAU,QAAQ,IAAI,IAAI,OAAO,KAAK,OAAO;AAAA,MAC5D,cAAc,6BAA6B,kBAAkB,IAAI,EAAE,CAAC,KAAK;AAAA,IAC3E,GAAG,qBAAqB,IAAI,IAAI,EAAE,GAAG,8BAA8B,IAAI,IAAI,eAAe,KAAK,CAAC,CAAC,CAAC;AAElG,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,EAAE,QAAQ,cAAc,UAAU,mBAAmB,IAAI;AAAA,IAC1E;AACA,UAAM,WAAW,MAAM,uBAAuB,WAAW,yBAAyB,eAAe;AAEjG,QAAI;AACJ,QAAI,WAAW,SAAS,SAAS,GAAG;AAClC,YAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,mBAAa,aAAa;AAAA,QACxB,IAAI,KAAK;AAAA,QACT,WAAW,qBAAqB,KAAK,cAAc,WAAW,IAAI;AAAA,MACpE,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,SAAS;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,qBAAqB,SAAS,IAAI,OAAO;AAAA,QAClD,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,qCAAqC,8BAA8B,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,4BAA4B,EAC/B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO;AAAA,EAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/C,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,cAAc,EAAE;AAAA,IACd,EAAE,OAAO;AAAA,MACP,QAAQ,EACL,OAAO,EACP,KAAK,EACL,SAAS,EACT;AAAA,QACC;AAAA,MACF;AAAA,MACF,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,CAAC;AAAA,EACH,EAAE,SAAS,EAAE,SAAS;AAAA,EACtB,iBAAiB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE;AAAA,IAChB,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,OAAO,EAAE,OAAO;AAAA,IAClB,CAAC;AAAA,EACH,EAAE,SAAS,EAAE,SAAS;AAAA,EACtB,kBAAkB,EACf,OAAO;AAAA,IACN,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,IACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,EACZ,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACpE,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,YAAY;AAEf,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,MAAM,yBAAyB;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,UAAU,2BAA2B;AAAA,EAChD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAC1C,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": ["sentinel"]
 }

package/dist/modules/customers/api/labels/assign/route.js

@@ -4,6 +4,7 @@ import { labelAssignCommandSchema, labelAssignmentSchema } from "../../../data/v
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, notFound } from "@open-mercato/shared/lib/crud/errors";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -51,7 +52,7 @@ async function POST(req) {
       request: req,
       selectedId: body.organizationId ?? void 0
     });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!organizationId) {
       throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
     }

package/dist/modules/customers/api/labels/assign/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/labels/assign/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { CustomerEntity } from '../../../data/entities'\nimport { labelAssignCommandSchema, labelAssignmentSchema, type LabelAssignCommandInput } from '../../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport { resolveLabelActorUserId } from '../auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from '../table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('customers')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst labelAssignmentRequestSchema = labelAssignmentSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nfunction resolveResourceKind(kind: 'person' | 'company' | null | undefined): string {\n  if (kind === 'company') return 'customers.company'\n  return 'customers.person'\n}\n\nfunction resolveRequiredFeature(kind: 'person' | 'company' | null | undefined): string {\n  return kind === 'company' ? 'customers.companies.manage' : 'customers.people.manage'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const targetEntity = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      {\n        id: body.entityId,\n        tenantId: auth.tenantId,\n        organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId },\n    )\n    if (!targetEntity) {\n      throw notFound(translate('customers.errors.entity_not_found', 'Entity not found'))\n    }\n    const entityKind = targetEntity.kind === 'person' || targetEntity.kind === 'company' ? targetEntity.kind : null\n    const resourceKind = resolveResourceKind(entityKind)\n\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (!rbac) {\n      throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n    }\n    const requiredFeature = resolveRequiredFeature(entityKind)\n    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasFeature) {\n      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind,\n      resourceId: body.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelAssignCommandSchema.parse({\n      labelId: body.labelId,\n      entityId: body.entityId,\n      tenantId: auth.tenantId,\n      organizationId,\n    } satisfies LabelAssignCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelAssignCommandInput, { assignmentId: string; created: boolean; entityKind: 'person' | 'company' | null }>(\n      'customers.labels.assign',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind,\n        resourceId: body.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result.assignmentId }, { status: result.created ? 201 : 200 })\n    if (result.created && logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.labelAssignment',\n          resourceId: logEntry.resourceId ?? result.assignmentId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('customers/labels/assign.POST', { err })\n    const { translate: fallbackTranslate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: fallbackTranslate('customers.errors.failed_to_assign_label', 'Failed to assign label') },\n      { status: 500 },\n    )\n  }\n}\n\nconst responseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Assign label to entity',\n  methods: {\n    POST: {\n      summary: 'Assign label',\n      requestBody: { contentType: 'application/json', schema: labelAssignmentRequestSchema },\n      responses: [\n        { status: 201, description: 'Assigned', schema: responseSchema },\n        { status: 200, description: 'Already assigned', schema: responseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Label or entity not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B,6BAA2D;AAC9F,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,iBAAiB,gBAAgB;AAKzD,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,+BAA+B,sBAAsB,OAAO;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,SAAS,oBAAoB,MAAuD;AAClF,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAuD;AACrF,SAAO,SAAS,YAAY,+BAA+B;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,6BAA6B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC3E,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,KAAK;AAAA,QACT,UAAU,KAAK;AAAA,QACf;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IAC5C;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,IACnF;AACA,UAAM,aAAa,aAAa,SAAS,YAAY,aAAa,SAAS,YAAY,aAAa,OAAO;AAC3G,UAAM,eAAe,oBAAoB,UAAU;AAEnD,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,IAClG;AACA,UAAM,kBAAkB,uBAAuB,UAAU;AACzD,UAAM,aAAa,MAAM,KAAK,mBAAmB,aAAa,CAAC,eAAe,GAAG;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,IACtG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,yBAAyB,MAAM;AAAA,MAClD,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAmC;AAEnC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,aAAa,GAAG,EAAE,QAAQ,OAAO,UAAU,MAAM,IAAI,CAAC;AACtG,QAAI,OAAO,WAAW,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC9E,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,gCAAgC,EAAE,IAAI,CAAC;AACpD,UAAM,EAAE,WAAW,kBAAkB,IAAI,MAAM,oBAAoB;AACnE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kBAAkB,2CAA2C,wBAAwB,EAAE;AAAA,MAChG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,eAAe;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,eAAe;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { CustomerEntity } from '../../../data/entities'\nimport { labelAssignCommandSchema, labelAssignmentSchema, type LabelAssignCommandInput } from '../../../data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport { resolveLabelActorUserId } from '../auth'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport {\n  createMissingCustomerLabelTablesError,\n  isMissingCustomerLabelTable,\n} from '../table-errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('customers')\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst labelAssignmentRequestSchema = labelAssignmentSchema.extend({\n  organizationId: z.string().uuid().optional(),\n})\n\nfunction resolveResourceKind(kind: 'person' | 'company' | null | undefined): string {\n  if (kind === 'company') return 'customers.company'\n  return 'customers.person'\n}\n\nfunction resolveRequiredFeature(kind: 'person' | 'company' | null | undefined): string {\n  return kind === 'company' ? 'customers.companies.manage' : 'customers.people.manage'\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { translate } = await resolveTranslations()\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveLabelActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('customers.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = labelAssignmentRequestSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: req,\n      selectedId: body.organizationId ?? undefined,\n    })\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const targetEntity = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      {\n        id: body.entityId,\n        tenantId: auth.tenantId,\n        organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId },\n    )\n    if (!targetEntity) {\n      throw notFound(translate('customers.errors.entity_not_found', 'Entity not found'))\n    }\n    const entityKind = targetEntity.kind === 'person' || targetEntity.kind === 'company' ? targetEntity.kind : null\n    const resourceKind = resolveResourceKind(entityKind)\n\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (!rbac) {\n      throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n    }\n    const requiredFeature = resolveRequiredFeature(entityKind)\n    const hasFeature = await rbac.userHasAllFeatures(actorUserId, [requiredFeature], {\n      tenantId: auth.tenantId,\n      organizationId,\n    })\n    if (!hasFeature) {\n      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n    }\n\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n      resourceKind,\n      resourceId: body.entityId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandInput = labelAssignCommandSchema.parse({\n      labelId: body.labelId,\n      entityId: body.entityId,\n      tenantId: auth.tenantId,\n      organizationId,\n    } satisfies LabelAssignCommandInput)\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<LabelAssignCommandInput, { assignmentId: string; created: boolean; entityKind: 'person' | 'company' | null }>(\n      'customers.labels.assign',\n      {\n        input: commandInput,\n        ctx: {\n          container,\n          auth,\n          organizationScope: scope,\n          selectedOrganizationId: organizationId,\n          organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n          request: req,\n        },\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId,\n        userId: actorUserId,\n        resourceKind,\n        resourceId: body.entityId,\n        operation: 'custom',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const response = NextResponse.json({ id: result.assignmentId }, { status: result.created ? 201 : 200 })\n    if (result.created && logEntry?.undoToken && logEntry.id && logEntry.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.labelAssignment',\n          resourceId: logEntry.resourceId ?? result.assignmentId,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isMissingCustomerLabelTable(err)) {\n      const migrationError = await createMissingCustomerLabelTablesError()\n      return NextResponse.json(migrationError.body, { status: migrationError.status })\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('customers/labels/assign.POST', { err })\n    const { translate: fallbackTranslate } = await resolveTranslations()\n    return NextResponse.json(\n      { error: fallbackTranslate('customers.errors.failed_to_assign_label', 'Failed to assign label') },\n      { status: 500 },\n    )\n  }\n}\n\nconst responseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Assign label to entity',\n  methods: {\n    POST: {\n      summary: 'Assign label',\n      requestBody: { contentType: 'application/json', schema: labelAssignmentRequestSchema },\n      responses: [\n        { status: 201, description: 'Assigned', schema: responseSchema },\n        { status: 200, description: 'Already assigned', schema: responseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Label or entity not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B,6BAA2D;AAC9F,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,iBAAiB,gBAAgB;AAKzD,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,+BAA+B,sBAAsB,OAAO;AAAA,EAChE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,SAAS,oBAAoB,MAAuD;AAClF,MAAI,SAAS,UAAW,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,uBAAuB,MAAuD;AACrF,SAAO,SAAS,YAAY,+BAA+B;AAC7D;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,wBAAwB,IAAI;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AAEA,UAAM,OAAO,6BAA6B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC3E,UAAM,QAAQ,MAAM,mCAAmC;AAAA,MACrD;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,YAAY,KAAK,kBAAkB;AAAA,IACrC,CAAC;AACD,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IACjI;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,KAAK;AAAA,QACT,UAAU,KAAK;AAAA,QACf;AAAA,QACA,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IAC5C;AACA,QAAI,CAAC,cAAc;AACjB,YAAM,SAAS,UAAU,qCAAqC,kBAAkB,CAAC;AAAA,IACnF;AACA,UAAM,aAAa,aAAa,SAAS,YAAY,aAAa,SAAS,YAAY,aAAa,OAAO;AAC3G,UAAM,eAAe,oBAAoB,UAAU;AAEnD,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,IAClG;AACA,UAAM,kBAAkB,uBAAuB,UAAU;AACzD,UAAM,aAAa,MAAM,KAAK,mBAAmB,aAAa,CAAC,eAAe,GAAG;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,IACtG;AAEA,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,eAAe,yBAAyB,MAAM;AAAA,MAClD,SAAS,KAAK;AAAA,MACd,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAmC;AAEnC,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,UAClE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,aAAa,GAAG,EAAE,QAAQ,OAAO,UAAU,MAAM,IAAI,CAAC;AACtG,QAAI,OAAO,WAAW,UAAU,aAAa,SAAS,MAAM,SAAS,WAAW;AAC9E,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,QAC7G,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,4BAA4B,GAAG,GAAG;AACpC,YAAM,iBAAiB,MAAM,sCAAsC;AACnE,aAAO,aAAa,KAAK,eAAe,MAAM,EAAE,QAAQ,eAAe,OAAO,CAAC;AAAA,IACjF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,gCAAgC,EAAE,IAAI,CAAC;AACpD,UAAM,EAAE,WAAW,kBAAkB,IAAI,MAAM,oBAAoB;AACnE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kBAAkB,2CAA2C,wBAAwB,EAAE;AAAA,MAChG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,eAAe;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,eAAe;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/labels/route.js

@@ -5,6 +5,7 @@ import { labelCreateCommandSchema, labelCreateSchema } from "../../data/validato
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -67,7 +68,7 @@ async function GET(req) {
       request: req,
       selectedId: query.organizationId ?? void 0
     });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!organizationId) {
       throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
     }
@@ -171,7 +172,7 @@ async function POST(req) {
       request: req,
       selectedId: body.organizationId ?? void 0
     });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     if (!organizationId) {
       throw new CrudHttpError(400, { error: translate("customers.errors.organization_required", "Organization context is required") });
     }