@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/sales/widgets/notifications/SalesOrderCreatedRenderer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/widgets/notifications/SalesOrderCreatedRenderer.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { ShoppingCart, ExternalLink, Loader2, X } from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\nimport { formatMoney } from '../../components/documents/lineItemUtils'\nimport { useSalesDocumentTotals } from './useSalesDocumentTotals'\n\nfunction normalizeTotal(value?: string | null): string | null {\n  if (!value) return null\n  let trimmed = value.trim()\n  if (trimmed.startsWith('(') && trimmed.endsWith(')')) {\n    trimmed = trimmed.slice(1, -1).trim()\n  }\n  return trimmed.length ? trimmed : null\n}\n\nexport function SalesOrderCreatedRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const isUnread = notification.status === 'unread'\n  const orderNumber = notification.bodyVariables?.orderNumber ?? notification.titleVariables?.orderNumber\n  const fallbackTotal =\n    normalizeTotal(notification.bodyVariables?.totalAmount ?? null) ??\n    normalizeTotal(notification.bodyVariables?.total ?? null)\n  const { totals } = useSalesDocumentTotals('order', notification.sourceEntityId)\n\n  const currentTotal =\n    totals && typeof totals.grandTotalGrossAmount === 'number'\n      ? formatMoney(totals.grandTotalGrossAmount, totals.currencyCode)\n      : fallbackTotal\n\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n\n  const handleView = async () => {\n    if (!viewAction) {\n      if (notification.linkHref) router.push(notification.linkHref)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  const timeAgo = formatRelativeTime(notification.createdAt, { locale, translate: t }) ?? ''\n\n  return (\n    <div\n      className={cn(\n        'group relative flex gap-4 items-start rounded-xl p-3 transition-colors hover:bg-muted/40 cursor-pointer',\n        isUnread && 'bg-muted/20',\n      )}\n      onClick={handleView}\n      onKeyDown={(e) => {\n        if (e.key === 'Enter' || e.key === ' ') {\n          e.preventDefault()\n          handleView()\n        }\n      }}\n      role=\"button\"\n      tabIndex={0}\n    >\n      {/* Avatar: indigo-tinted circle with shopping-cart icon */}\n      <div className=\"relative shrink-0 flex size-10 items-center justify-center rounded-full bg-status-info-bg\">\n        <ShoppingCart className=\"size-5 text-status-info-icon\" aria-hidden=\"true\" />\n        {isUnread ? (\n          <span\n            className=\"absolute -right-1 -top-1 size-3 rounded-full bg-accent-indigo ring-2 ring-background\"\n            aria-hidden=\"true\"\n          />\n        ) : null}\n      </div>\n\n      <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n        {/* Title row */}\n        <p className=\"truncate text-sm font-medium leading-5 tracking-tight text-foreground\">\n          {notification.title}\n        </p>\n\n        {/* Description row: time \u00B7 order# \u00B7 total \u00B7 assigned \u2014 inline so it wraps naturally per line */}\n        <div className=\"text-xs leading-4 text-muted-foreground\">\n          {timeAgo ? (\n            <>\n              <span className=\"whitespace-nowrap\">{timeAgo}</span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          {orderNumber ? (\n            <>\n              <span className=\"inline-flex items-center rounded bg-muted px-1.5 py-0.5 font-mono text-overline text-foreground\">\n                #{orderNumber}\n              </span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          {currentTotal ? (\n            <>\n              <span className=\"whitespace-nowrap font-medium text-foreground\">{currentTotal}</span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          <span className=\"whitespace-nowrap\">{t('sales.notifications.renderer.assignedToYou', 'Assigned to you')}</span>\n        </div>\n\n        {/* Actions row */}\n        <div className=\"mt-2 flex items-center gap-2\">\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            className=\"h-8 rounded-md px-2.5 bg-accent-indigo text-accent-indigo-foreground hover:bg-accent-indigo/90\"\n            onClick={(e) => {\n              e.stopPropagation()\n              handleView()\n            }}\n            disabled={executing || (!viewAction && !notification.linkHref)}\n          >\n            <ExternalLink className=\"size-3.5\" aria-hidden=\"true\" />\n            {t('sales.notifications.renderer.viewOrder', 'View Order')}\n            {executing ? <Loader2 className=\"ml-1 size-3 animate-spin\" /> : null}\n          </Button>\n          <Button\n            type=\"button\"\n            variant=\"outline\"\n            size=\"sm\"\n            className=\"h-8 rounded-md px-2.5\"\n            onClick={(e) => {\n              e.stopPropagation()\n              onDismiss()\n            }}\n          >\n            {t('notifications.actions.dismiss', 'Dismiss')}\n          </Button>\n        </div>\n      </div>\n\n      <IconButton\n        type=\"button\"\n        variant=\"ghost\"\n        size=\"xs\"\n        className=\"absolute right-2 top-2 opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100\"\n        onClick={(e) => {\n          e.stopPropagation()\n          onDismiss()\n        }}\n        aria-label={t('notifications.actions.dismiss', 'Dismiss')}\n      >\n        <X className=\"size-3.5\" />\n      </IconButton>\n    </div>\n  )\n}\n\nexport default SalesOrderCreatedRenderer\n"],
-  "mappings": ";AA+EM,SAmBM,UAlBJ,KADF;AA7EN,YAAY,WAAW;AACvB,SAAS,cAAc,cAAc,SAAS,SAAS;AACvD,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,UAAU;AACnB,SAAS,0BAA0B;AACnC,SAAS,WAAW,YAAY;AAEhC,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAEvC,SAAS,eAAe,OAAsC;AAC5D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,UAAU,MAAM,KAAK;AACzB,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,cAAU,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EACtC;AACA,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,gBACJ,eAAe,aAAa,eAAe,eAAe,IAAI,KAC9D,eAAe,aAAa,eAAe,SAAS,IAAI;AAC1D,QAAM,EAAE,OAAO,IAAI,uBAAuB,SAAS,aAAa,cAAc;AAE9E,QAAM,eACJ,UAAU,OAAO,OAAO,0BAA0B,WAC9C,YAAY,OAAO,uBAAuB,OAAO,YAAY,IAC7D;AAEN,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AAEnF,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,YAAY;AACf,UAAI,aAAa,SAAU,QAAO,KAAK,aAAa,QAAQ;AAC5D;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,aAAa,WAAW,EAAE,QAAQ,WAAW,EAAE,CAAC,KAAK;AAExF,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,YAAY;AAAA,MACd;AAAA,MACA,SAAS;AAAA,MACT,WAAW,CAAC,MAAM;AAChB,YAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,YAAE,eAAe;AACjB,qBAAW;AAAA,QACb;AAAA,MACF;AAAA,MACA,MAAK;AAAA,MACL,UAAU;AAAA,MAGV;AAAA,6BAAC,SAAI,WAAU,6FACb;AAAA,8BAAC,gBAAa,WAAU,gCAA+B,eAAY,QAAO;AAAA,UACzE,WACC;AAAA,YAAC;AAAA;AAAA,cACC,WAAU;AAAA,cACV,eAAY;AAAA;AAAA,UACd,IACE;AAAA,WACN;AAAA,QAEA,qBAAC,SAAI,WAAU,sCAEb;AAAA,8BAAC,OAAE,WAAU,yEACV,uBAAa,OAChB;AAAA,UAGA,qBAAC,SAAI,WAAU,2CACZ;AAAA,sBACC,iCACE;AAAA,kCAAC,UAAK,WAAU,qBAAqB,mBAAQ;AAAA,cAC7C,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACH,cACC,iCACE;AAAA,mCAAC,UAAK,WAAU,mGAAkG;AAAA;AAAA,gBAC9G;AAAA,iBACJ;AAAA,cACA,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACH,eACC,iCACE;AAAA,kCAAC,UAAK,WAAU,iDAAiD,wBAAa;AAAA,cAC9E,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACJ,oBAAC,UAAK,WAAU,qBAAqB,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,aAC1G;AAAA,UAGA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,MAAM;AACd,oBAAE,gBAAgB;AAClB,6BAAW;AAAA,gBACb;AAAA,gBACA,UAAU,aAAc,CAAC,cAAc,CAAC,aAAa;AAAA,gBAErD;AAAA,sCAAC,gBAAa,WAAU,YAAW,eAAY,QAAO;AAAA,kBACrD,EAAE,0CAA0C,YAAY;AAAA,kBACxD,YAAY,oBAAC,WAAQ,WAAU,4BAA2B,IAAK;AAAA;AAAA;AAAA,YAClE;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,SAAQ;AAAA,gBACR,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,MAAM;AACd,oBAAE,gBAAgB;AAClB,4BAAU;AAAA,gBACZ;AAAA,gBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,YAC/C;AAAA,aACF;AAAA,WACF;AAAA,QAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,CAAC,MAAM;AACd,gBAAE,gBAAgB;AAClB,wBAAU;AAAA,YACZ;AAAA,YACA,cAAY,EAAE,iCAAiC,SAAS;AAAA,YAExD,8BAAC,KAAE,WAAU,YAAW;AAAA;AAAA,QAC1B;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,oCAAQ;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { ShoppingCart, ExternalLink, Loader2, X } from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\nimport { formatMoney } from '../../components/documents/lineItemUtils'\nimport { useSalesDocumentTotals } from './useSalesDocumentTotals'\n\nfunction normalizeTotal(value?: string | null): string | null {\n  if (!value) return null\n  let trimmed = value.trim()\n  if (trimmed.startsWith('(') && trimmed.endsWith(')')) {\n    trimmed = trimmed.slice(1, -1).trim()\n  }\n  return trimmed.length ? trimmed : null\n}\n\nexport function SalesOrderCreatedRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const isUnread = notification.status === 'unread'\n  const orderNumber = notification.bodyVariables?.orderNumber ?? notification.titleVariables?.orderNumber\n  const fallbackTotal =\n    normalizeTotal(notification.bodyVariables?.totalAmount ?? null) ??\n    normalizeTotal(notification.bodyVariables?.total ?? null)\n  const { totals } = useSalesDocumentTotals('order', notification.sourceEntityId)\n\n  const currentTotal =\n    totals && typeof totals.grandTotalGrossAmount === 'number'\n      ? formatMoney(totals.grandTotalGrossAmount, totals.currencyCode)\n      : fallbackTotal\n\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n\n  const handleView = async () => {\n    if (!viewAction || notification.status === 'actioned') {\n      if (notification.linkHref) router.push(notification.linkHref)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  const timeAgo = formatRelativeTime(notification.createdAt, { locale, translate: t }) ?? ''\n\n  return (\n    <div\n      className={cn(\n        'group relative flex gap-4 items-start rounded-xl p-3 transition-colors hover:bg-muted/40 cursor-pointer',\n        isUnread && 'bg-muted/20',\n      )}\n      onClick={handleView}\n      onKeyDown={(e) => {\n        if (e.key === 'Enter' || e.key === ' ') {\n          e.preventDefault()\n          handleView()\n        }\n      }}\n      role=\"button\"\n      tabIndex={0}\n    >\n      {/* Avatar: indigo-tinted circle with shopping-cart icon */}\n      <div className=\"relative shrink-0 flex size-10 items-center justify-center rounded-full bg-status-info-bg\">\n        <ShoppingCart className=\"size-5 text-status-info-icon\" aria-hidden=\"true\" />\n        {isUnread ? (\n          <span\n            className=\"absolute -right-1 -top-1 size-3 rounded-full bg-accent-indigo ring-2 ring-background\"\n            aria-hidden=\"true\"\n          />\n        ) : null}\n      </div>\n\n      <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n        {/* Title row */}\n        <p className=\"truncate text-sm font-medium leading-5 tracking-tight text-foreground\">\n          {notification.title}\n        </p>\n\n        {/* Description row: time \u00B7 order# \u00B7 total \u00B7 assigned \u2014 inline so it wraps naturally per line */}\n        <div className=\"text-xs leading-4 text-muted-foreground\">\n          {timeAgo ? (\n            <>\n              <span className=\"whitespace-nowrap\">{timeAgo}</span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          {orderNumber ? (\n            <>\n              <span className=\"inline-flex items-center rounded bg-muted px-1.5 py-0.5 font-mono text-overline text-foreground\">\n                #{orderNumber}\n              </span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          {currentTotal ? (\n            <>\n              <span className=\"whitespace-nowrap font-medium text-foreground\">{currentTotal}</span>\n              <span aria-hidden=\"true\" className=\"mx-1 text-text-disabled\">\u00B7</span>\n            </>\n          ) : null}\n          <span className=\"whitespace-nowrap\">{t('sales.notifications.renderer.assignedToYou', 'Assigned to you')}</span>\n        </div>\n\n        {/* Actions row */}\n        <div className=\"mt-2 flex items-center gap-2\">\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            className=\"h-8 rounded-md px-2.5 bg-accent-indigo text-accent-indigo-foreground hover:bg-accent-indigo/90\"\n            onClick={(e) => {\n              e.stopPropagation()\n              handleView()\n            }}\n            disabled={executing || (!viewAction && !notification.linkHref) || (notification.status === 'actioned' && !notification.linkHref)}\n          >\n            <ExternalLink className=\"size-3.5\" aria-hidden=\"true\" />\n            {t('sales.notifications.renderer.viewOrder', 'View Order')}\n            {executing ? <Loader2 className=\"ml-1 size-3 animate-spin\" /> : null}\n          </Button>\n          <Button\n            type=\"button\"\n            variant=\"outline\"\n            size=\"sm\"\n            className=\"h-8 rounded-md px-2.5\"\n            onClick={(e) => {\n              e.stopPropagation()\n              onDismiss()\n            }}\n          >\n            {t('notifications.actions.dismiss', 'Dismiss')}\n          </Button>\n        </div>\n      </div>\n\n      <IconButton\n        type=\"button\"\n        variant=\"ghost\"\n        size=\"xs\"\n        className=\"absolute right-2 top-2 opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100\"\n        onClick={(e) => {\n          e.stopPropagation()\n          onDismiss()\n        }}\n        aria-label={t('notifications.actions.dismiss', 'Dismiss')}\n      >\n        <X className=\"size-3.5\" />\n      </IconButton>\n    </div>\n  )\n}\n\nexport default SalesOrderCreatedRenderer\n"],
+  "mappings": ";AA+EM,SAmBM,UAlBJ,KADF;AA7EN,YAAY,WAAW;AACvB,SAAS,cAAc,cAAc,SAAS,SAAS;AACvD,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,UAAU;AACnB,SAAS,0BAA0B;AACnC,SAAS,WAAW,YAAY;AAEhC,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAEvC,SAAS,eAAe,OAAsC;AAC5D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,UAAU,MAAM,KAAK;AACzB,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,cAAU,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EACtC;AACA,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,gBACJ,eAAe,aAAa,eAAe,eAAe,IAAI,KAC9D,eAAe,aAAa,eAAe,SAAS,IAAI;AAC1D,QAAM,EAAE,OAAO,IAAI,uBAAuB,SAAS,aAAa,cAAc;AAE9E,QAAM,eACJ,UAAU,OAAO,OAAO,0BAA0B,WAC9C,YAAY,OAAO,uBAAuB,OAAO,YAAY,IAC7D;AAEN,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AAEnF,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,cAAc,aAAa,WAAW,YAAY;AACrD,UAAI,aAAa,SAAU,QAAO,KAAK,aAAa,QAAQ;AAC5D;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,UAAU,mBAAmB,aAAa,WAAW,EAAE,QAAQ,WAAW,EAAE,CAAC,KAAK;AAExF,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,YAAY;AAAA,MACd;AAAA,MACA,SAAS;AAAA,MACT,WAAW,CAAC,MAAM;AAChB,YAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,YAAE,eAAe;AACjB,qBAAW;AAAA,QACb;AAAA,MACF;AAAA,MACA,MAAK;AAAA,MACL,UAAU;AAAA,MAGV;AAAA,6BAAC,SAAI,WAAU,6FACb;AAAA,8BAAC,gBAAa,WAAU,gCAA+B,eAAY,QAAO;AAAA,UACzE,WACC;AAAA,YAAC;AAAA;AAAA,cACC,WAAU;AAAA,cACV,eAAY;AAAA;AAAA,UACd,IACE;AAAA,WACN;AAAA,QAEA,qBAAC,SAAI,WAAU,sCAEb;AAAA,8BAAC,OAAE,WAAU,yEACV,uBAAa,OAChB;AAAA,UAGA,qBAAC,SAAI,WAAU,2CACZ;AAAA,sBACC,iCACE;AAAA,kCAAC,UAAK,WAAU,qBAAqB,mBAAQ;AAAA,cAC7C,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACH,cACC,iCACE;AAAA,mCAAC,UAAK,WAAU,mGAAkG;AAAA;AAAA,gBAC9G;AAAA,iBACJ;AAAA,cACA,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACH,eACC,iCACE;AAAA,kCAAC,UAAK,WAAU,iDAAiD,wBAAa;AAAA,cAC9E,oBAAC,UAAK,eAAY,QAAO,WAAU,2BAA0B,kBAAC;AAAA,eAChE,IACE;AAAA,YACJ,oBAAC,UAAK,WAAU,qBAAqB,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,aAC1G;AAAA,UAGA,qBAAC,SAAI,WAAU,gCACb;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,MAAM;AACd,oBAAE,gBAAgB;AAClB,6BAAW;AAAA,gBACb;AAAA,gBACA,UAAU,aAAc,CAAC,cAAc,CAAC,aAAa,YAAc,aAAa,WAAW,cAAc,CAAC,aAAa;AAAA,gBAEvH;AAAA,sCAAC,gBAAa,WAAU,YAAW,eAAY,QAAO;AAAA,kBACrD,EAAE,0CAA0C,YAAY;AAAA,kBACxD,YAAY,oBAAC,WAAQ,WAAU,4BAA2B,IAAK;AAAA;AAAA;AAAA,YAClE;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,SAAQ;AAAA,gBACR,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,MAAM;AACd,oBAAE,gBAAgB;AAClB,4BAAU;AAAA,gBACZ;AAAA,gBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,YAC/C;AAAA,aACF;AAAA,WACF;AAAA,QAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,CAAC,MAAM;AACd,gBAAE,gBAAgB;AAClB,wBAAU;AAAA,YACZ;AAAA,YACA,cAAY,EAAE,iCAAiC,SAAS;AAAA,YAExD,8BAAC,KAAE,WAAU,YAAW;AAAA;AAAA,QAC1B;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,oCAAQ;",
   "names": []
 }

package/dist/modules/sales/widgets/notifications/SalesQuoteCreatedRenderer.js

@@ -34,7 +34,7 @@ function SalesQuoteCreatedRenderer({
   const currentTotal = totals && typeof totals.grandTotalGrossAmount === "number" ? formatMoney(totals.grandTotalGrossAmount, totals.currencyCode) : fallbackTotal;
   const viewAction = actions.find((action) => action.id === "view") ?? actions[0] ?? null;
   const handleView = async () => {
-    if (!viewAction) {
+    if (!viewAction || notification.status === "actioned") {
       if (notification.linkHref) router.push(notification.linkHref);
       return;
     }
@@ -99,7 +99,7 @@ function SalesQuoteCreatedRenderer({
                     e.stopPropagation();
                     handleView();
                   },
-                  disabled: executing || !viewAction && !notification.linkHref,
+                  disabled: executing || !viewAction && !notification.linkHref || notification.status === "actioned" && !notification.linkHref,
                   className: "gap-1",
                   children: [
                     /* @__PURE__ */ jsx(ExternalLink, { className: "h-3 w-3" }),

package/dist/modules/sales/widgets/notifications/SalesQuoteCreatedRenderer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sales/widgets/notifications/SalesQuoteCreatedRenderer.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { FileText, ExternalLink, DollarSign, User, Calendar } from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\nimport { formatMoney } from '../../components/documents/lineItemUtils'\nimport { useSalesDocumentTotals } from './useSalesDocumentTotals'\n\nfunction normalizeTotal(value?: string | null): string | null {\n  if (!value) return null\n  let trimmed = value.trim()\n  if (trimmed.startsWith('(') && trimmed.endsWith(')')) {\n    trimmed = trimmed.slice(1, -1).trim()\n  }\n  return trimmed.length ? trimmed : null\n}\n\nexport function SalesQuoteCreatedRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const isUnread = notification.status === 'unread'\n  const quoteNumber = notification.bodyVariables?.quoteNumber ?? notification.titleVariables?.quoteNumber\n  const fallbackTotal =\n    normalizeTotal(notification.bodyVariables?.totalAmount ?? null) ??\n    normalizeTotal(notification.bodyVariables?.total ?? null)\n  const { totals } = useSalesDocumentTotals('quote', notification.sourceEntityId)\n\n  const currentTotal =\n    totals && typeof totals.grandTotalGrossAmount === 'number'\n      ? formatMoney(totals.grandTotalGrossAmount, totals.currencyCode)\n      : fallbackTotal\n\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n\n  const handleView = async () => {\n    if (!viewAction) {\n      if (notification.linkHref) router.push(notification.linkHref)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  return (\n    <div\n      className={cn(\n        'group relative px-4 py-3 hover:bg-muted/50 cursor-pointer transition-colors border-l-4 border-l-status-warning-border',\n        isUnread && 'bg-status-warning-bg/50'\n      )}\n      onClick={handleView}\n      onKeyDown={(e) => {\n        if (e.key === 'Enter' || e.key === ' ') {\n          e.preventDefault()\n          handleView()\n        }\n      }}\n      role=\"button\"\n      tabIndex={0}\n    >\n      {isUnread && (\n        <div className=\"absolute left-1.5 top-1/2 -translate-y-1/2 h-2 w-2 rounded-full bg-primary\" />\n      )}\n\n      <div className=\"flex gap-3\">\n        <div className=\"flex-shrink-0 mt-0.5\">\n          <div className=\"h-10 w-10 rounded-lg bg-status-warning-bg flex items-center justify-center\">\n            <FileText className=\"h-5 w-5 text-status-warning-icon\" />\n          </div>\n        </div>\n\n        <div className=\"flex-1 min-w-0\">\n          <div className=\"flex items-start justify-between gap-2\">\n            <div>\n              <h4 className={cn('text-sm font-medium', isUnread && 'font-semibold')}>\n                {notification.title}\n              </h4>\n              {quoteNumber && (\n                <div className=\"flex items-center gap-1 mt-0.5\">\n                  <span className=\"text-xs font-mono text-muted-foreground bg-muted px-1.5 py-0.5 rounded\">\n                    #{quoteNumber}\n                  </span>\n                </div>\n              )}\n            </div>\n            <span className=\"flex-shrink-0 text-xs text-muted-foreground flex items-center gap-1\">\n              <Calendar className=\"h-3 w-3\" />\n              {formatRelativeTime(notification.createdAt, { locale, translate: t }) ?? ''}\n            </span>\n          </div>\n\n          <div className=\"mt-2 flex items-center gap-4 text-xs text-muted-foreground\">\n            {currentTotal && (\n              <div className=\"flex items-center gap-1\">\n                <DollarSign className=\"h-3 w-3\" />\n                <span className=\"font-medium text-foreground\">{currentTotal}</span>\n              </div>\n            )}\n            <div className=\"flex items-center gap-1\">\n              <User className=\"h-3 w-3\" />\n              <span>{t('sales.notifications.renderer.pendingReview', 'Pending review')}</span>\n            </div>\n          </div>\n\n          <div className=\"mt-3 flex gap-2\">\n            <Button\n              variant=\"default\"\n              size=\"sm\"\n              onClick={(e) => {\n                e.stopPropagation()\n                handleView()\n              }}\n              disabled={executing || (!viewAction && !notification.linkHref)}\n              className=\"gap-1\"\n            >\n              <ExternalLink className=\"h-3 w-3\" />\n              {t('sales.notifications.renderer.viewQuote', 'View Quote')}\n            </Button>\n            <Button\n              variant=\"ghost\"\n              size=\"sm\"\n              onClick={(e) => {\n                e.stopPropagation()\n                onDismiss()\n              }}\n            >\n              {t('notifications.actions.dismiss', 'Dismiss')}\n            </Button>\n          </div>\n        </div>\n      </div>\n    </div>\n  )\n}\n\nexport default SalesQuoteCreatedRenderer\n"],
-  "mappings": ";AA4EQ,cAkBU,YAlBV;AA1ER,YAAY,WAAW;AACvB,SAAS,UAAU,cAAc,YAAY,MAAM,gBAAgB;AACnE,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,UAAU;AACnB,SAAS,WAAW,YAAY;AAChC,SAAS,0BAA0B;AAEnC,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAEvC,SAAS,eAAe,OAAsC;AAC5D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,UAAU,MAAM,KAAK;AACzB,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,cAAU,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EACtC;AACA,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,gBACJ,eAAe,aAAa,eAAe,eAAe,IAAI,KAC9D,eAAe,aAAa,eAAe,SAAS,IAAI;AAC1D,QAAM,EAAE,OAAO,IAAI,uBAAuB,SAAS,aAAa,cAAc;AAE9E,QAAM,eACJ,UAAU,OAAO,OAAO,0BAA0B,WAC9C,YAAY,OAAO,uBAAuB,OAAO,YAAY,IAC7D;AAEN,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AAEnF,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,YAAY;AACf,UAAI,aAAa,SAAU,QAAO,KAAK,aAAa,QAAQ;AAC5D;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,YAAY;AAAA,MACd;AAAA,MACA,SAAS;AAAA,MACT,WAAW,CAAC,MAAM;AAChB,YAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,YAAE,eAAe;AACjB,qBAAW;AAAA,QACb;AAAA,MACF;AAAA,MACA,MAAK;AAAA,MACL,UAAU;AAAA,MAET;AAAA,oBACC,oBAAC,SAAI,WAAU,8EAA6E;AAAA,QAG9F,qBAAC,SAAI,WAAU,cACb;AAAA,8BAAC,SAAI,WAAU,wBACb,8BAAC,SAAI,WAAU,8EACb,8BAAC,YAAS,WAAU,oCAAmC,GACzD,GACF;AAAA,UAEA,qBAAC,SAAI,WAAU,kBACb;AAAA,iCAAC,SAAI,WAAU,0CACb;AAAA,mCAAC,SACC;AAAA,oCAAC,QAAG,WAAW,GAAG,uBAAuB,YAAY,eAAe,GACjE,uBAAa,OAChB;AAAA,gBACC,eACC,oBAAC,SAAI,WAAU,kCACb,+BAAC,UAAK,WAAU,0EAAyE;AAAA;AAAA,kBACrF;AAAA,mBACJ,GACF;AAAA,iBAEJ;AAAA,cACA,qBAAC,UAAK,WAAU,uEACd;AAAA,oCAAC,YAAS,WAAU,WAAU;AAAA,gBAC7B,mBAAmB,aAAa,WAAW,EAAE,QAAQ,WAAW,EAAE,CAAC,KAAK;AAAA,iBAC3E;AAAA,eACF;AAAA,YAEA,qBAAC,SAAI,WAAU,8DACZ;AAAA,8BACC,qBAAC,SAAI,WAAU,2BACb;AAAA,oCAAC,cAAW,WAAU,WAAU;AAAA,gBAChC,oBAAC,UAAK,WAAU,+BAA+B,wBAAa;AAAA,iBAC9D;AAAA,cAEF,qBAAC,SAAI,WAAU,2BACb;AAAA,oCAAC,QAAK,WAAU,WAAU;AAAA,gBAC1B,oBAAC,UAAM,YAAE,8CAA8C,gBAAgB,GAAE;AAAA,iBAC3E;AAAA,eACF;AAAA,YAEA,qBAAC,SAAI,WAAU,mBACb;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAQ;AAAA,kBACR,MAAK;AAAA,kBACL,SAAS,CAAC,MAAM;AACd,sBAAE,gBAAgB;AAClB,+BAAW;AAAA,kBACb;AAAA,kBACA,UAAU,aAAc,CAAC,cAAc,CAAC,aAAa;AAAA,kBACrD,WAAU;AAAA,kBAEV;AAAA,wCAAC,gBAAa,WAAU,WAAU;AAAA,oBACjC,EAAE,0CAA0C,YAAY;AAAA;AAAA;AAAA,cAC3D;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAQ;AAAA,kBACR,MAAK;AAAA,kBACL,SAAS,CAAC,MAAM;AACd,sBAAE,gBAAgB;AAClB,8BAAU;AAAA,kBACZ;AAAA,kBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,cAC/C;AAAA,eACF;AAAA,aACF;AAAA,WACF;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,oCAAQ;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { FileText, ExternalLink, DollarSign, User, Calendar } from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport { useLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\nimport { formatMoney } from '../../components/documents/lineItemUtils'\nimport { useSalesDocumentTotals } from './useSalesDocumentTotals'\n\nfunction normalizeTotal(value?: string | null): string | null {\n  if (!value) return null\n  let trimmed = value.trim()\n  if (trimmed.startsWith('(') && trimmed.endsWith(')')) {\n    trimmed = trimmed.slice(1, -1).trim()\n  }\n  return trimmed.length ? trimmed : null\n}\n\nexport function SalesQuoteCreatedRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const isUnread = notification.status === 'unread'\n  const quoteNumber = notification.bodyVariables?.quoteNumber ?? notification.titleVariables?.quoteNumber\n  const fallbackTotal =\n    normalizeTotal(notification.bodyVariables?.totalAmount ?? null) ??\n    normalizeTotal(notification.bodyVariables?.total ?? null)\n  const { totals } = useSalesDocumentTotals('quote', notification.sourceEntityId)\n\n  const currentTotal =\n    totals && typeof totals.grandTotalGrossAmount === 'number'\n      ? formatMoney(totals.grandTotalGrossAmount, totals.currencyCode)\n      : fallbackTotal\n\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n\n  const handleView = async () => {\n    if (!viewAction || notification.status === 'actioned') {\n      if (notification.linkHref) router.push(notification.linkHref)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  return (\n    <div\n      className={cn(\n        'group relative px-4 py-3 hover:bg-muted/50 cursor-pointer transition-colors border-l-4 border-l-status-warning-border',\n        isUnread && 'bg-status-warning-bg/50'\n      )}\n      onClick={handleView}\n      onKeyDown={(e) => {\n        if (e.key === 'Enter' || e.key === ' ') {\n          e.preventDefault()\n          handleView()\n        }\n      }}\n      role=\"button\"\n      tabIndex={0}\n    >\n      {isUnread && (\n        <div className=\"absolute left-1.5 top-1/2 -translate-y-1/2 h-2 w-2 rounded-full bg-primary\" />\n      )}\n\n      <div className=\"flex gap-3\">\n        <div className=\"flex-shrink-0 mt-0.5\">\n          <div className=\"h-10 w-10 rounded-lg bg-status-warning-bg flex items-center justify-center\">\n            <FileText className=\"h-5 w-5 text-status-warning-icon\" />\n          </div>\n        </div>\n\n        <div className=\"flex-1 min-w-0\">\n          <div className=\"flex items-start justify-between gap-2\">\n            <div>\n              <h4 className={cn('text-sm font-medium', isUnread && 'font-semibold')}>\n                {notification.title}\n              </h4>\n              {quoteNumber && (\n                <div className=\"flex items-center gap-1 mt-0.5\">\n                  <span className=\"text-xs font-mono text-muted-foreground bg-muted px-1.5 py-0.5 rounded\">\n                    #{quoteNumber}\n                  </span>\n                </div>\n              )}\n            </div>\n            <span className=\"flex-shrink-0 text-xs text-muted-foreground flex items-center gap-1\">\n              <Calendar className=\"h-3 w-3\" />\n              {formatRelativeTime(notification.createdAt, { locale, translate: t }) ?? ''}\n            </span>\n          </div>\n\n          <div className=\"mt-2 flex items-center gap-4 text-xs text-muted-foreground\">\n            {currentTotal && (\n              <div className=\"flex items-center gap-1\">\n                <DollarSign className=\"h-3 w-3\" />\n                <span className=\"font-medium text-foreground\">{currentTotal}</span>\n              </div>\n            )}\n            <div className=\"flex items-center gap-1\">\n              <User className=\"h-3 w-3\" />\n              <span>{t('sales.notifications.renderer.pendingReview', 'Pending review')}</span>\n            </div>\n          </div>\n\n          <div className=\"mt-3 flex gap-2\">\n            <Button\n              variant=\"default\"\n              size=\"sm\"\n              onClick={(e) => {\n                e.stopPropagation()\n                handleView()\n              }}\n              disabled={executing || (!viewAction && !notification.linkHref) || (notification.status === 'actioned' && !notification.linkHref)}\n              className=\"gap-1\"\n            >\n              <ExternalLink className=\"h-3 w-3\" />\n              {t('sales.notifications.renderer.viewQuote', 'View Quote')}\n            </Button>\n            <Button\n              variant=\"ghost\"\n              size=\"sm\"\n              onClick={(e) => {\n                e.stopPropagation()\n                onDismiss()\n              }}\n            >\n              {t('notifications.actions.dismiss', 'Dismiss')}\n            </Button>\n          </div>\n        </div>\n      </div>\n    </div>\n  )\n}\n\nexport default SalesQuoteCreatedRenderer\n"],
+  "mappings": ";AA4EQ,cAkBU,YAlBV;AA1ER,YAAY,WAAW;AACvB,SAAS,UAAU,cAAc,YAAY,MAAM,gBAAgB;AACnE,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,UAAU;AACnB,SAAS,WAAW,YAAY;AAChC,SAAS,0BAA0B;AAEnC,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAEvC,SAAS,eAAe,OAAsC;AAC5D,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,UAAU,MAAM,KAAK;AACzB,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,cAAU,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AAAA,EACtC;AACA,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEO,SAAS,0BAA0B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,gBACJ,eAAe,aAAa,eAAe,eAAe,IAAI,KAC9D,eAAe,aAAa,eAAe,SAAS,IAAI;AAC1D,QAAM,EAAE,OAAO,IAAI,uBAAuB,SAAS,aAAa,cAAc;AAE9E,QAAM,eACJ,UAAU,OAAO,OAAO,0BAA0B,WAC9C,YAAY,OAAO,uBAAuB,OAAO,YAAY,IAC7D;AAEN,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AAEnF,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,cAAc,aAAa,WAAW,YAAY;AACrD,UAAI,aAAa,SAAU,QAAO,KAAK,aAAa,QAAQ;AAC5D;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,YAAY;AAAA,MACd;AAAA,MACA,SAAS;AAAA,MACT,WAAW,CAAC,MAAM;AAChB,YAAI,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AACtC,YAAE,eAAe;AACjB,qBAAW;AAAA,QACb;AAAA,MACF;AAAA,MACA,MAAK;AAAA,MACL,UAAU;AAAA,MAET;AAAA,oBACC,oBAAC,SAAI,WAAU,8EAA6E;AAAA,QAG9F,qBAAC,SAAI,WAAU,cACb;AAAA,8BAAC,SAAI,WAAU,wBACb,8BAAC,SAAI,WAAU,8EACb,8BAAC,YAAS,WAAU,oCAAmC,GACzD,GACF;AAAA,UAEA,qBAAC,SAAI,WAAU,kBACb;AAAA,iCAAC,SAAI,WAAU,0CACb;AAAA,mCAAC,SACC;AAAA,oCAAC,QAAG,WAAW,GAAG,uBAAuB,YAAY,eAAe,GACjE,uBAAa,OAChB;AAAA,gBACC,eACC,oBAAC,SAAI,WAAU,kCACb,+BAAC,UAAK,WAAU,0EAAyE;AAAA;AAAA,kBACrF;AAAA,mBACJ,GACF;AAAA,iBAEJ;AAAA,cACA,qBAAC,UAAK,WAAU,uEACd;AAAA,oCAAC,YAAS,WAAU,WAAU;AAAA,gBAC7B,mBAAmB,aAAa,WAAW,EAAE,QAAQ,WAAW,EAAE,CAAC,KAAK;AAAA,iBAC3E;AAAA,eACF;AAAA,YAEA,qBAAC,SAAI,WAAU,8DACZ;AAAA,8BACC,qBAAC,SAAI,WAAU,2BACb;AAAA,oCAAC,cAAW,WAAU,WAAU;AAAA,gBAChC,oBAAC,UAAK,WAAU,+BAA+B,wBAAa;AAAA,iBAC9D;AAAA,cAEF,qBAAC,SAAI,WAAU,2BACb;AAAA,oCAAC,QAAK,WAAU,WAAU;AAAA,gBAC1B,oBAAC,UAAM,YAAE,8CAA8C,gBAAgB,GAAE;AAAA,iBAC3E;AAAA,eACF;AAAA,YAEA,qBAAC,SAAI,WAAU,mBACb;AAAA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAQ;AAAA,kBACR,MAAK;AAAA,kBACL,SAAS,CAAC,MAAM;AACd,sBAAE,gBAAgB;AAClB,+BAAW;AAAA,kBACb;AAAA,kBACA,UAAU,aAAc,CAAC,cAAc,CAAC,aAAa,YAAc,aAAa,WAAW,cAAc,CAAC,aAAa;AAAA,kBACvH,WAAU;AAAA,kBAEV;AAAA,wCAAC,gBAAa,WAAU,WAAU;AAAA,oBACjC,EAAE,0CAA0C,YAAY;AAAA;AAAA;AAAA,cAC3D;AAAA,cACA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAQ;AAAA,kBACR,MAAK;AAAA,kBACL,SAAS,CAAC,MAAM;AACd,sBAAE,gBAAgB;AAClB,8BAAU;AAAA,kBACZ;AAAA,kBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,cAC/C;AAAA,eACF;AAAA,aACF;AAAA,WACF;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,oCAAQ;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/accept/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -28,7 +29,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/leave-requests/accept/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/accept/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.accept',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.accept failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.accept', 'Failed to approve leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Approve leave request',\n  methods: {\n    POST: {\n      summary: 'Approve leave request',\n      description: 'Approves a leave request and adds unavailability rules for the staff member.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request approved', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests/reject/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -28,7 +29,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/leave-requests/reject/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/leave-requests/reject/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const body = await req.json().catch(() => ({}))\n    const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)\n\n    const auth = ctx.auth\n    const tenantId = auth?.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: input,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(\n      'staff.leave-requests.reject',\n      { input, ctx },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth?.sub ?? '',\n        resourceKind: 'staff.leave_request',\n        resourceId: result?.requestId ?? input.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.leave_request',\n          resourceId: logEntry.resourceId ?? result?.requestId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.leave-requests.reject failed', { err })\n    return NextResponse.json({ error: translate('staff.leaveRequests.errors.reject', 'Failed to reject leave request.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Reject leave request',\n  methods: {\n    POST: {\n      summary: 'Reject leave request',\n      description: 'Rejects a leave request with an optional comment.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffLeaveRequestDecisionSchema,\n      },\n      responses: [\n        { status: 200, description: 'Leave request rejected', schema: z.object({ ok: z.literal(true), id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,uCAA4E;AACrF;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC9E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAE3F,UAAM,OAAO,IAAI;AACjB,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA,EAAE,OAAO,IAAI;AAAA,IACf;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,MAAM,OAAO;AAAA,QACrB,cAAc;AAAA,QACd,YAAY,QAAQ,aAAa,MAAM;AAAA,QACvC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/F,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,aAAa;AAAA,UACxD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAClI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/leave-requests.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { makeCrudRoute } from "@open-mercato/shared/lib/crud/factory";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -70,7 +71,7 @@ async function resolveLeaveRequestAccess(ctx) {
     return { canManage: false, canSend: false, canView: false, memberId: null };
   }
   const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null;
-  const organizationId = ctx.selectedOrganizationId ?? ctx.organizationScope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? resolveSingleOrganizationIdOrDeny(ctx.organizationScope, auth) ?? null;
   const rbac = ctx.container.resolve("rbacService");
   const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([
     rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),

package/dist/modules/staff/api/leave-requests.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/staff/api/leave-requests.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffLeaveRequest, StaffTeamMember } from '../data/entities'\nimport {\n  staffLeaveRequestCreateSchema,\n  staffLeaveRequestUpdateSchema,\n  staffLeaveRequestDecisionSchema,\n} from '../data/validators'\nimport { sanitizeSearchTerm } from './helpers'\nimport { E } from '#generated/entities.ids.generated'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from './openapi'\n\nconst MANAGE_FEATURE = 'staff.leave_requests.manage'\nconst SEND_FEATURE = 'staff.leave_requests.send'\nconst MY_VIEW_FEATURE = 'staff.my_leave_requests.view'\nconst MY_SEND_FEATURE = 'staff.my_leave_requests.send'\n\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\n\nconst routeMetadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true },\n  PUT: { requireAuth: true },\n  DELETE: { requireAuth: true },\n}\n\nexport const metadata = routeMetadata\n\n// Field constants for StaffLeaveRequest entity\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  member_id: 'member_id',\n  start_date: 'start_date',\n  end_date: 'end_date',\n  timezone: 'timezone',\n  status: 'status',\n  unavailability_reason_entry_id: 'unavailability_reason_entry_id',\n  unavailability_reason_value: 'unavailability_reason_value',\n  note: 'note',\n  decision_comment: 'decision_comment',\n  submitted_by_user_id: 'submitted_by_user_id',\n  decided_by_user_id: 'decided_by_user_id',\n  decided_at: 'decided_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    search: z.string().optional(),\n    status: z.enum(['pending', 'approved', 'rejected']).optional(),\n    memberId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype LeaveRequestAccess = {\n  canManage: boolean\n  canSend: boolean\n  canView: boolean\n  memberId: string | null\n}\n\nconst uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nfunction resolveActorUserId(ctx: { auth?: { sub?: string | null; isApiKey?: boolean } | null }): string | null {\n  if (!ctx.auth || ctx.auth.isApiKey) return null\n  const sub = ctx.auth.sub ?? null\n  if (!sub || !uuidRegex.test(sub)) return null\n  return sub\n}\n\nasync function resolveLeaveRequestAccess(ctx: any): Promise<LeaveRequestAccess> {\n  const auth = ctx.auth\n  if (!auth || !auth.sub || auth.isApiKey) {\n    return { canManage: false, canSend: false, canView: false, memberId: null }\n  }\n  const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? ctx.organizationScope?.selectedId ?? auth.orgId ?? null\n  const rbac = (ctx.container.resolve('rbacService') as RbacService)\n  const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([\n    rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_VIEW_FEATURE], { tenantId, organizationId }),\n  ])\n  const canSend = canSendLegacy || canSendSelf\n  const canView = canManage || canSend || canViewSelf\n  if (!canManage && !canView) {\n    return { canManage, canSend, canView, memberId: null }\n  }\n  const member = await findOneWithDecryption(\n    ctx.container.resolve('em') as EntityManager,\n    StaffTeamMember,\n    { userId: auth.sub, deletedAt: null },\n    undefined,\n    { tenantId, organizationId },\n  )\n  return { canManage, canSend, canView, memberId: member?.id ?? null }\n}\n\nexport async function buildLeaveRequestFilters(\n  query: z.infer<typeof listSchema>,\n  ctx: CrudCtx,\n) {\n  const filters: Record<string, unknown> = {}\n  if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n    const ids = query.ids\n      .split(',')\n      .map((value) => value.trim())\n      .filter((value) => value.length > 0)\n    if (ids.length > 0) {\n      filters[F.id] = { $in: ids }\n    }\n  }\n  if (query.status) {\n    filters[F.status] = query.status\n  }\n  if (query.memberId) {\n    filters[F.member_id] = query.memberId\n  }\n  const term = sanitizeSearchTerm(query.search)\n  if (term) {\n    const like = `%${escapeLikePattern(term)}%`\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      { displayName: { $ilike: like }, deletedAt: null },\n      { fields: ['id'] },\n      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    const memberIds = members.map((member) => member.id)\n    if (!memberIds.length) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = { $in: memberIds }\n    }\n  }\n\n  const access = await resolveLeaveRequestAccess(ctx)\n  if (!access.canManage) {\n    if (!access.canView || !access.memberId) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = access.memberId\n    }\n  }\n  return filters\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffLeaveRequest,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.staff.staff_leave_request },\n  list: {\n    schema: listSchema,\n    entityId: E.staff.staff_leave_request,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.member_id,\n      F.start_date,\n      F.end_date,\n      F.timezone,\n      F.status,\n      F.unavailability_reason_entry_id,\n      F.unavailability_reason_value,\n      F.note,\n      F.decision_comment,\n      F.submitted_by_user_id,\n      F.decided_by_user_id,\n      F.decided_at,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      startDate: F.start_date,\n      endDate: F.end_date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: buildLeaveRequestFilters,\n  },\n  hooks: {\n    afterList: async (payload, ctx) => {\n      const items: Array<Record<string, unknown>> = Array.isArray(payload?.items)\n        ? (payload.items as Array<Record<string, unknown>>)\n        : []\n      if (!items.length) {\n        payload.viewer = await resolveLeaveRequestAccess(ctx)\n        return\n      }\n      const memberIds = new Set<string>()\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (memberId) memberIds.add(memberId)\n      })\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const members = memberIds.size\n        ? await findWithDecryption(\n            em,\n            StaffTeamMember,\n            { id: { $in: Array.from(memberIds) } },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n        : []\n      const memberById = new Map(members.map((member) => [member.id, member]))\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (!memberId) return\n        const member = memberById.get(memberId)\n        if (!member) return\n        item.member = {\n          id: member.id,\n          displayName: member.displayName,\n          userId: member.userId ?? null,\n        }\n      })\n      payload.viewer = await resolveLeaveRequestAccess(ctx)\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.leave-requests.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        const payload = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>) } : {}\n        const actorUserId = resolveActorUserId(ctx)\n        if (actorUserId) payload.submittedByUserId = actorUserId\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(400, { error: translate('staff.leaveRequests.errors.profileRequired', 'Create your profile first.') })\n          }\n          payload.memberId = access.memberId\n        }\n        return parseScopedCommandInput(staffLeaveRequestCreateSchema, payload, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.requestId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.leave-requests.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(staffLeaveRequestUpdateSchema, raw ?? {}, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id: parsed.id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          if (parsed.memberId && parsed.memberId !== memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.leave-requests.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst leaveRequestListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  member_id: z.string().uuid().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  end_date: z.string().nullable().optional(),\n  timezone: z.string().nullable().optional(),\n  status: z.enum(['pending', 'approved', 'rejected']).nullable().optional(),\n  unavailability_reason_entry_id: z.string().uuid().nullable().optional(),\n  unavailability_reason_value: z.string().nullable().optional(),\n  note: z.string().nullable().optional(),\n  decision_comment: z.string().nullable().optional(),\n  submitted_by_user_id: z.string().uuid().nullable().optional(),\n  decided_by_user_id: z.string().uuid().nullable().optional(),\n  decided_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  member: z\n    .object({\n      id: z.string().uuid().nullable().optional(),\n      displayName: z.string().nullable().optional(),\n      userId: z.string().uuid().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst leaveRequestListResponseSchema = createPagedListResponseSchema(leaveRequestListItemSchema).extend({\n  viewer: z\n    .object({\n      canManage: z.boolean(),\n      canSend: z.boolean(),\n      canView: z.boolean(),\n      memberId: z.string().uuid().nullable(),\n    })\n    .optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'Leave request',\n  pluralName: 'Leave requests',\n  querySchema: listSchema,\n  listResponseSchema: leaveRequestListResponseSchema,\n  create: {\n    schema: staffLeaveRequestCreateSchema,\n    description: 'Creates a leave request for a staff member.',\n  },\n  update: {\n    schema: staffLeaveRequestUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a leave request by id.',\n  },\n  del: {\n    schema: staffLeaveRequestDecisionSchema.pick({ id: true }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a leave request by id.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,qBAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,mBAAmB,uBAAuB;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,iBAAiB;AACvB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,WAAW;AAEjB,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,KAAK;AAAA,EAC1B,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,QAAQ,EAAE,aAAa,KAAK;AAC9B;AAEO,MAAM,WAAW;AAGxB,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,gCAAgC;AAAA,EAChC,6BAA6B;AAAA,EAC7B,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AASf,MAAM,YAAY;AAElB,SAAS,mBAAmB,KAAmF;AAC7G,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,SAAU,QAAO;AAC3C,QAAM,MAAM,IAAI,KAAK,OAAO;AAC5B,MAAI,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,EAAG,QAAO;AACzC,SAAO;AACT;AAEA,eAAe,0BAA0B,KAAuC;AAC9E,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,KAAK,UAAU;AACvC,WAAO,EAAE,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,UAAU,KAAK;AAAA,EAC5E;AACA,QAAM,WAAW,IAAI,mBAAmB,YAAY,KAAK,YAAY;AACrE,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,mBAAmB,cAAc,KAAK,SAAS;AACxG,QAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,QAAM,CAAC,WAAW,eAAe,aAAa,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7E,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAChF,KAAK,mBAAmB,KAAK,KAAK,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC9E,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IACjF,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EACnF,CAAC;AACD,QAAM,UAAU,iBAAiB;AACjC,QAAM,UAAU,aAAa,WAAW;AACxC,MAAI,CAAC,aAAa,CAAC,SAAS;AAC1B,WAAO,EAAE,WAAW,SAAS,SAAS,UAAU,KAAK;AAAA,EACvD;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAU,QAAQ,MAAM,KAAK;AACrE;AAEA,eAAsB,yBACpB,OACA,KACA;AACA,QAAM,UAAmC,CAAC;AAC1C,MAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,UAAM,MAAM,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAI,IAAI,SAAS,GAAG;AAClB,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,QAAQ;AAChB,YAAQ,EAAE,MAAM,IAAI,MAAM;AAAA,EAC5B;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,EAAE,SAAS,IAAI,MAAM;AAAA,EAC/B;AACA,QAAM,OAAO,mBAAmB,MAAM,MAAM;AAC5C,MAAI,MAAM;AACR,UAAM,OAAO,IAAI,kBAAkB,IAAI,CAAC;AACxC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,aAAa,EAAE,QAAQ,KAAK,GAAG,WAAW,KAAK;AAAA,MACjD,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,MACjB,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IAC7F;AACA,UAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE;AACnD,QAAI,CAAC,UAAU,QAAQ;AACrB,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,UAAU;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,MAAI,CAAC,OAAO,WAAW;AACrB,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,UAAU;AACvC,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,MAAM;AAAA,IAClB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,SAAS,QAAQ;AACjC,YAAM,QAAwC,MAAM,QAAQ,SAAS,KAAK,IACrE,QAAQ,QACT,CAAC;AACL,UAAI,CAAC,MAAM,QAAQ;AACjB,gBAAQ,SAAS,MAAM,0BAA0B,GAAG;AACpD;AAAA,MACF;AACA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,SAAU,WAAU,IAAI,QAAQ;AAAA,MACtC,CAAC;AACD,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,YAAM,UAAU,UAAU,OACtB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE;AAAA,QACrC;AAAA,QACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,MAC7F,IACA,CAAC;AACL,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AACvE,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,YAAI,CAAC,OAAQ;AACb,aAAK,SAAS;AAAA,UACZ,IAAI,OAAO;AAAA,UACX,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AACD,cAAQ,SAAS,MAAM,0BAA0B,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,cAAM,UAAU,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,IAAgC,IAAI,CAAC;AAC5F,cAAM,cAAc,mBAAmB,GAAG;AAC1C,YAAI,YAAa,SAAQ,oBAAoB;AAC7C,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8CAA8C,4BAA4B,EAAE,CAAC;AAAA,UAC/H;AACA,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,eAAO,wBAAwB,+BAA+B,SAAS,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,aAAa,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,+BAA+B,OAAO,CAAC,GAAG,KAAK,SAAS;AAC/F,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,YACjC;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,cAAI,OAAO,YAAY,OAAO,aAAa,UAAU;AACnD,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,WAAW,KAAK;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,8BAA8B,0BAA0B,EAAE,OAAO;AAAA,EACtG,QAAQ,EACL,OAAO;AAAA,IACN,WAAW,EAAE,QAAQ;AAAA,IACrB,SAAS,EAAE,QAAQ;AAAA,IACnB,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS;AACd,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,gCAAgC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACzD,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffLeaveRequest, StaffTeamMember } from '../data/entities'\nimport {\n  staffLeaveRequestCreateSchema,\n  staffLeaveRequestUpdateSchema,\n  staffLeaveRequestDecisionSchema,\n} from '../data/validators'\nimport { sanitizeSearchTerm } from './helpers'\nimport { E } from '#generated/entities.ids.generated'\nimport { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from './openapi'\n\nconst MANAGE_FEATURE = 'staff.leave_requests.manage'\nconst SEND_FEATURE = 'staff.leave_requests.send'\nconst MY_VIEW_FEATURE = 'staff.my_leave_requests.view'\nconst MY_SEND_FEATURE = 'staff.my_leave_requests.send'\n\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\n\nconst routeMetadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true },\n  PUT: { requireAuth: true },\n  DELETE: { requireAuth: true },\n}\n\nexport const metadata = routeMetadata\n\n// Field constants for StaffLeaveRequest entity\nconst F = {\n  id: 'id',\n  tenant_id: 'tenant_id',\n  organization_id: 'organization_id',\n  member_id: 'member_id',\n  start_date: 'start_date',\n  end_date: 'end_date',\n  timezone: 'timezone',\n  status: 'status',\n  unavailability_reason_entry_id: 'unavailability_reason_entry_id',\n  unavailability_reason_value: 'unavailability_reason_value',\n  note: 'note',\n  decision_comment: 'decision_comment',\n  submitted_by_user_id: 'submitted_by_user_id',\n  decided_by_user_id: 'decided_by_user_id',\n  decided_at: 'decided_at',\n  created_at: 'created_at',\n  updated_at: 'updated_at',\n  deleted_at: 'deleted_at',\n} as const\n\nconst rawBodySchema = z.object({}).passthrough()\n\nconst listSchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(50),\n    search: z.string().optional(),\n    status: z.enum(['pending', 'approved', 'rejected']).optional(),\n    memberId: z.string().uuid().optional(),\n    ids: z.string().optional(),\n    sortField: z.string().optional(),\n    sortDir: z.enum(['asc', 'desc']).optional(),\n  })\n  .passthrough()\n\ntype LeaveRequestAccess = {\n  canManage: boolean\n  canSend: boolean\n  canView: boolean\n  memberId: string | null\n}\n\nconst uuidRegex = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/\n\nfunction resolveActorUserId(ctx: { auth?: { sub?: string | null; isApiKey?: boolean } | null }): string | null {\n  if (!ctx.auth || ctx.auth.isApiKey) return null\n  const sub = ctx.auth.sub ?? null\n  if (!sub || !uuidRegex.test(sub)) return null\n  return sub\n}\n\nasync function resolveLeaveRequestAccess(ctx: any): Promise<LeaveRequestAccess> {\n  const auth = ctx.auth\n  if (!auth || !auth.sub || auth.isApiKey) {\n    return { canManage: false, canSend: false, canView: false, memberId: null }\n  }\n  const tenantId = ctx.organizationScope?.tenantId ?? auth.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? resolveSingleOrganizationIdOrDeny(ctx.organizationScope, auth) ?? null\n  const rbac = (ctx.container.resolve('rbacService') as RbacService)\n  const [canManage, canSendLegacy, canSendSelf, canViewSelf] = await Promise.all([\n    rbac.userHasAllFeatures(auth.sub, [MANAGE_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_SEND_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [MY_VIEW_FEATURE], { tenantId, organizationId }),\n  ])\n  const canSend = canSendLegacy || canSendSelf\n  const canView = canManage || canSend || canViewSelf\n  if (!canManage && !canView) {\n    return { canManage, canSend, canView, memberId: null }\n  }\n  const member = await findOneWithDecryption(\n    ctx.container.resolve('em') as EntityManager,\n    StaffTeamMember,\n    { userId: auth.sub, deletedAt: null },\n    undefined,\n    { tenantId, organizationId },\n  )\n  return { canManage, canSend, canView, memberId: member?.id ?? null }\n}\n\nexport async function buildLeaveRequestFilters(\n  query: z.infer<typeof listSchema>,\n  ctx: CrudCtx,\n) {\n  const filters: Record<string, unknown> = {}\n  if (typeof query.ids === 'string' && query.ids.trim().length > 0) {\n    const ids = query.ids\n      .split(',')\n      .map((value) => value.trim())\n      .filter((value) => value.length > 0)\n    if (ids.length > 0) {\n      filters[F.id] = { $in: ids }\n    }\n  }\n  if (query.status) {\n    filters[F.status] = query.status\n  }\n  if (query.memberId) {\n    filters[F.member_id] = query.memberId\n  }\n  const term = sanitizeSearchTerm(query.search)\n  if (term) {\n    const like = `%${escapeLikePattern(term)}%`\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      { displayName: { $ilike: like }, deletedAt: null },\n      { fields: ['id'] },\n      { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    const memberIds = members.map((member) => member.id)\n    if (!memberIds.length) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = { $in: memberIds }\n    }\n  }\n\n  const access = await resolveLeaveRequestAccess(ctx)\n  if (!access.canManage) {\n    if (!access.canView || !access.memberId) {\n      filters[F.id] = NIL_UUID\n    } else {\n      filters[F.member_id] = access.memberId\n    }\n  }\n  return filters\n}\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: StaffLeaveRequest,\n    idField: 'id',\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.staff.staff_leave_request },\n  list: {\n    schema: listSchema,\n    entityId: E.staff.staff_leave_request,\n    fields: [\n      F.id,\n      F.organization_id,\n      F.tenant_id,\n      F.member_id,\n      F.start_date,\n      F.end_date,\n      F.timezone,\n      F.status,\n      F.unavailability_reason_entry_id,\n      F.unavailability_reason_value,\n      F.note,\n      F.decision_comment,\n      F.submitted_by_user_id,\n      F.decided_by_user_id,\n      F.decided_at,\n      F.created_at,\n      F.updated_at,\n    ],\n    sortFieldMap: {\n      startDate: F.start_date,\n      endDate: F.end_date,\n      createdAt: F.created_at,\n      updatedAt: F.updated_at,\n    },\n    buildFilters: buildLeaveRequestFilters,\n  },\n  hooks: {\n    afterList: async (payload, ctx) => {\n      const items: Array<Record<string, unknown>> = Array.isArray(payload?.items)\n        ? (payload.items as Array<Record<string, unknown>>)\n        : []\n      if (!items.length) {\n        payload.viewer = await resolveLeaveRequestAccess(ctx)\n        return\n      }\n      const memberIds = new Set<string>()\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (memberId) memberIds.add(memberId)\n      })\n      const em = (ctx.container.resolve('em') as EntityManager).fork()\n      const members = memberIds.size\n        ? await findWithDecryption(\n            em,\n            StaffTeamMember,\n            { id: { $in: Array.from(memberIds) } },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n        : []\n      const memberById = new Map(members.map((member) => [member.id, member]))\n      items.forEach((item) => {\n        const memberId = typeof item.memberId === 'string'\n          ? item.memberId\n          : typeof item.member_id === 'string'\n            ? item.member_id\n            : null\n        if (!memberId) return\n        const member = memberById.get(memberId)\n        if (!member) return\n        item.member = {\n          id: member.id,\n          displayName: member.displayName,\n          userId: member.userId ?? null,\n        }\n      })\n      payload.viewer = await resolveLeaveRequestAccess(ctx)\n    },\n  },\n  actions: {\n    create: {\n      commandId: 'staff.leave-requests.create',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        const payload = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>) } : {}\n        const actorUserId = resolveActorUserId(ctx)\n        if (actorUserId) payload.submittedByUserId = actorUserId\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(400, { error: translate('staff.leaveRequests.errors.profileRequired', 'Create your profile first.') })\n          }\n          payload.memberId = access.memberId\n        }\n        return parseScopedCommandInput(staffLeaveRequestCreateSchema, payload, ctx, translate)\n      },\n      response: ({ result }) => ({ id: result?.requestId ?? null }),\n      status: 201,\n    },\n    update: {\n      commandId: 'staff.leave-requests.update',\n      schema: rawBodySchema,\n      mapInput: async ({ raw, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const parsed = parseScopedCommandInput(staffLeaveRequestUpdateSchema, raw ?? {}, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id: parsed.id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          if (parsed.memberId && parsed.memberId !== memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return parsed\n      },\n      response: () => ({ ok: true }),\n    },\n    delete: {\n      commandId: 'staff.leave-requests.delete',\n      schema: rawBodySchema,\n      mapInput: async ({ parsed, ctx }) => {\n        const { translate } = await resolveTranslations()\n        const id = resolveCrudRecordId(parsed, ctx, translate)\n        const access = await resolveLeaveRequestAccess(ctx)\n        if (!access.canManage && !access.canSend) {\n          throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n        }\n        if (!access.canManage) {\n          if (!access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n          const em = (ctx.container.resolve('em') as EntityManager)\n          const request = await findOneWithDecryption(\n            em,\n            StaffLeaveRequest,\n            { id, deletedAt: null },\n            undefined,\n            { tenantId: ctx.auth?.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n          )\n          const memberId = request ? (typeof request.member === 'string' ? request.member : request.member.id) : null\n          if (!request || memberId !== access.memberId) {\n            throw new CrudHttpError(403, { error: translate('staff.leaveRequests.errors.forbidden', 'Forbidden') })\n          }\n        }\n        return { id }\n      },\n      response: () => ({ ok: true }),\n    },\n  },\n})\n\nexport const GET = crud.GET\nexport const POST = crud.POST\nexport const PUT = crud.PUT\nexport const DELETE = crud.DELETE\n\nconst leaveRequestListItemSchema = z.object({\n  id: z.string().uuid().nullable().optional(),\n  organization_id: z.string().uuid().nullable().optional(),\n  tenant_id: z.string().uuid().nullable().optional(),\n  member_id: z.string().uuid().nullable().optional(),\n  start_date: z.string().nullable().optional(),\n  end_date: z.string().nullable().optional(),\n  timezone: z.string().nullable().optional(),\n  status: z.enum(['pending', 'approved', 'rejected']).nullable().optional(),\n  unavailability_reason_entry_id: z.string().uuid().nullable().optional(),\n  unavailability_reason_value: z.string().nullable().optional(),\n  note: z.string().nullable().optional(),\n  decision_comment: z.string().nullable().optional(),\n  submitted_by_user_id: z.string().uuid().nullable().optional(),\n  decided_by_user_id: z.string().uuid().nullable().optional(),\n  decided_at: z.string().nullable().optional(),\n  created_at: z.string().nullable().optional(),\n  updated_at: z.string().nullable().optional(),\n  member: z\n    .object({\n      id: z.string().uuid().nullable().optional(),\n      displayName: z.string().nullable().optional(),\n      userId: z.string().uuid().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst leaveRequestListResponseSchema = createPagedListResponseSchema(leaveRequestListItemSchema).extend({\n  viewer: z\n    .object({\n      canManage: z.boolean(),\n      canSend: z.boolean(),\n      canView: z.boolean(),\n      memberId: z.string().uuid().nullable(),\n    })\n    .optional(),\n})\n\nexport const openApi = createStaffCrudOpenApi({\n  resourceName: 'Leave request',\n  pluralName: 'Leave requests',\n  querySchema: listSchema,\n  listResponseSchema: leaveRequestListResponseSchema,\n  create: {\n    schema: staffLeaveRequestCreateSchema,\n    description: 'Creates a leave request for a staff member.',\n  },\n  update: {\n    schema: staffLeaveRequestUpdateSchema,\n    responseSchema: defaultOkResponseSchema,\n    description: 'Updates a leave request by id.',\n  },\n  del: {\n    schema: staffLeaveRequestDecisionSchema.pick({ id: true }),\n    responseSchema: defaultOkResponseSchema,\n    description: 'Deletes a leave request by id.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,yCAAyC;AAClD,SAAS,qBAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB,+BAA+B;AAC7D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,mBAAmB,uBAAuB;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,wBAAwB,+BAA+B,+BAA+B;AAE/F,MAAM,iBAAiB;AACvB,MAAM,eAAe;AACrB,MAAM,kBAAkB;AACxB,MAAM,kBAAkB;AAExB,MAAM,WAAW;AAEjB,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,KAAK;AAAA,EAC1B,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,QAAQ,EAAE,aAAa,KAAK;AAC9B;AAEO,MAAM,WAAW;AAGxB,MAAM,IAAI;AAAA,EACR,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,gCAAgC;AAAA,EAChC,6BAA6B;AAAA,EAC7B,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AACd;AAEA,MAAM,gBAAgB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAE/C,MAAM,aAAa,EAChB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC,EACA,YAAY;AASf,MAAM,YAAY;AAElB,SAAS,mBAAmB,KAAmF;AAC7G,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,SAAU,QAAO;AAC3C,QAAM,MAAM,IAAI,KAAK,OAAO;AAC5B,MAAI,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,EAAG,QAAO;AACzC,SAAO;AACT;AAEA,eAAe,0BAA0B,KAAuC;AAC9E,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,KAAK,UAAU;AACvC,WAAO,EAAE,WAAW,OAAO,SAAS,OAAO,SAAS,OAAO,UAAU,KAAK;AAAA,EAC5E;AACA,QAAM,WAAW,IAAI,mBAAmB,YAAY,KAAK,YAAY;AACrE,QAAM,iBAAiB,IAAI,0BAA0B,kCAAkC,IAAI,mBAAmB,IAAI,KAAK;AACvH,QAAM,OAAQ,IAAI,UAAU,QAAQ,aAAa;AACjD,QAAM,CAAC,WAAW,eAAe,aAAa,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7E,KAAK,mBAAmB,KAAK,KAAK,CAAC,cAAc,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAChF,KAAK,mBAAmB,KAAK,KAAK,CAAC,YAAY,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC9E,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IACjF,KAAK,mBAAmB,KAAK,KAAK,CAAC,eAAe,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EACnF,CAAC;AACD,QAAM,UAAU,iBAAiB;AACjC,QAAM,UAAU,aAAa,WAAW;AACxC,MAAI,CAAC,aAAa,CAAC,SAAS;AAC1B,WAAO,EAAE,WAAW,SAAS,SAAS,UAAU,KAAK;AAAA,EACvD;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B;AAAA,IACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAU,QAAQ,MAAM,KAAK;AACrE;AAEA,eAAsB,yBACpB,OACA,KACA;AACA,QAAM,UAAmC,CAAC;AAC1C,MAAI,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,KAAK,EAAE,SAAS,GAAG;AAChE,UAAM,MAAM,MAAM,IACf,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC;AACrC,QAAI,IAAI,SAAS,GAAG;AAClB,cAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,MAAM,QAAQ;AAChB,YAAQ,EAAE,MAAM,IAAI,MAAM;AAAA,EAC5B;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,EAAE,SAAS,IAAI,MAAM;AAAA,EAC/B;AACA,QAAM,OAAO,mBAAmB,MAAM,MAAM;AAC5C,MAAI,MAAM;AACR,UAAM,OAAO,IAAI,kBAAkB,IAAI,CAAC;AACxC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,aAAa,EAAE,QAAQ,KAAK,GAAG,WAAW,KAAK;AAAA,MACjD,EAAE,QAAQ,CAAC,IAAI,EAAE;AAAA,MACjB,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IAC7F;AACA,UAAM,YAAY,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE;AACnD,QAAI,CAAC,UAAU,QAAQ;AACrB,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,EAAE,KAAK,UAAU;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,MAAI,CAAC,OAAO,WAAW;AACrB,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,UAAU;AACvC,cAAQ,EAAE,EAAE,IAAI;AAAA,IAClB,OAAO;AACL,cAAQ,EAAE,SAAS,IAAI,OAAO;AAAA,IAChC;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,MAAM;AAAA,IAClB,QAAQ;AAAA,MACN,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,MACF,EAAE;AAAA,IACJ;AAAA,IACA,cAAc;AAAA,MACZ,WAAW,EAAE;AAAA,MACb,SAAS,EAAE;AAAA,MACX,WAAW,EAAE;AAAA,MACb,WAAW,EAAE;AAAA,IACf;AAAA,IACA,cAAc;AAAA,EAChB;AAAA,EACA,OAAO;AAAA,IACL,WAAW,OAAO,SAAS,QAAQ;AACjC,YAAM,QAAwC,MAAM,QAAQ,SAAS,KAAK,IACrE,QAAQ,QACT,CAAC;AACL,UAAI,CAAC,MAAM,QAAQ;AACjB,gBAAQ,SAAS,MAAM,0BAA0B,GAAG;AACpD;AAAA,MACF;AACA,YAAM,YAAY,oBAAI,IAAY;AAClC,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,SAAU,WAAU,IAAI,QAAQ;AAAA,MACtC,CAAC;AACD,YAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,YAAM,UAAU,UAAU,OACtB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,SAAS,EAAE,EAAE;AAAA,QACrC;AAAA,QACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,MAC7F,IACA,CAAC;AACL,YAAM,aAAa,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;AACvE,YAAM,QAAQ,CAAC,SAAS;AACtB,cAAM,WAAW,OAAO,KAAK,aAAa,WACtC,KAAK,WACL,OAAO,KAAK,cAAc,WACxB,KAAK,YACL;AACN,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,YAAI,CAAC,OAAQ;AACb,aAAK,SAAS;AAAA,UACZ,IAAI,OAAO;AAAA,UACX,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO,UAAU;AAAA,QAC3B;AAAA,MACF,CAAC;AACD,cAAQ,SAAS,MAAM,0BAA0B,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,cAAM,UAAU,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,IAAgC,IAAI,CAAC;AAC5F,cAAM,cAAc,mBAAmB,GAAG;AAC1C,YAAI,YAAa,SAAQ,oBAAoB;AAC7C,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,8CAA8C,4BAA4B,EAAE,CAAC;AAAA,UAC/H;AACA,kBAAQ,WAAW,OAAO;AAAA,QAC5B;AACA,eAAO,wBAAwB,+BAA+B,SAAS,KAAK,SAAS;AAAA,MACvF;AAAA,MACA,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,QAAQ,aAAa,KAAK;AAAA,MAC3D,QAAQ;AAAA,IACV;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,KAAK,IAAI,MAAM;AAChC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,SAAS,wBAAwB,+BAA+B,OAAO,CAAC,GAAG,KAAK,SAAS;AAC/F,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,YACjC;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,cAAI,OAAO,YAAY,OAAO,aAAa,UAAU;AACnD,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ;AAAA,MACN,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,UAAU,OAAO,EAAE,QAAQ,IAAI,MAAM;AACnC,cAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,cAAM,KAAK,oBAAoB,QAAQ,KAAK,SAAS;AACrD,cAAM,SAAS,MAAM,0BAA0B,GAAG;AAClD,YAAI,CAAC,OAAO,aAAa,CAAC,OAAO,SAAS;AACxC,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,QACxG;AACA,YAAI,CAAC,OAAO,WAAW;AACrB,cAAI,CAAC,OAAO,UAAU;AACpB,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AACA,gBAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,gBAAM,UAAU,MAAM;AAAA,YACpB;AAAA,YACA;AAAA,YACA,EAAE,IAAI,WAAW,KAAK;AAAA,YACtB;AAAA,YACA,EAAE,UAAU,IAAI,MAAM,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,UAC7F;AACA,gBAAM,WAAW,UAAW,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS,QAAQ,OAAO,KAAM;AACvG,cAAI,CAAC,WAAW,aAAa,OAAO,UAAU;AAC5C,kBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wCAAwC,WAAW,EAAE,CAAC;AAAA,UACxG;AAAA,QACF;AACA,eAAO,EAAE,GAAG;AAAA,MACd;AAAA,MACA,UAAU,OAAO,EAAE,IAAI,KAAK;AAAA,IAC9B;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AACjB,MAAM,OAAO,KAAK;AAClB,MAAM,MAAM,KAAK;AACjB,MAAM,SAAS,KAAK;AAE3B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,QAAQ,EAAE,KAAK,CAAC,WAAW,YAAY,UAAU,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtE,6BAA6B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5D,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,iCAAiC,8BAA8B,0BAA0B,EAAE,OAAO;AAAA,EACtG,QAAQ,EACL,OAAO;AAAA,IACN,WAAW,EAAE,QAAQ;AAAA,IACrB,SAAS,EAAE,QAAQ;AAAA,IACnB,SAAS,EAAE,QAAQ;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS;AACd,CAAC;AAEM,MAAM,UAAU,uBAAuB;AAAA,EAC5C,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ,gCAAgC,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACzD,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/staff/api/team-members/self/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -33,7 +34,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };

package/dist/modules/staff/api/team-members/self/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/team-members/self/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTeamMember } from '../../../data/entities'\nimport {\n  staffTeamMemberSelfCreateSchema,\n  type StaffTeamMemberSelfCreateInput,\n  type StaffTeamMemberCreateInput,\n} from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.leave_requests.send'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.send'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nconst selfMemberResponseSchema = z.object({\n  member: z\n    .object({\n      id: z.string().uuid(),\n      displayName: z.string(),\n      userId: z.string().uuid().nullable(),\n      teamId: z.string().uuid().nullable(),\n      availabilityRuleSetId: z.string().uuid().nullable(),\n    })\n    .nullable(),\n})\n\nexport async function GET(req: Request) {\n  try {\n    const { ctx } = await buildContext(req)\n    const auth = ctx.auth\n    if (!auth?.sub) return NextResponse.json({ member: null })\n    const em = (ctx.container.resolve('em') as any)\n    const member = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    if (!member) return NextResponse.json({ member: null })\n    return NextResponse.json({\n      member: {\n        id: member.id,\n        displayName: member.displayName,\n        userId: member.userId ?? null,\n        teamId: member.teamId ?? null,\n        availabilityRuleSetId: member.availabilityRuleSetId ?? null,\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('staff.teamMembers.self.load failed', { err })\n    return NextResponse.json({ member: null })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const auth = ctx.auth\n    if (!auth?.sub) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    const body = await req.json().catch(() => ({}))\n    const parsed = parseScopedCommandInput(staffTeamMemberSelfCreateSchema, body, ctx, translate)\n    const em = (ctx.container.resolve('em') as any)\n    const existing = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    if (existing) {\n      throw new CrudHttpError(409, { error: translate('staff.teamMembers.self.exists', 'Team member profile already exists.') })\n    }\n\n    const tenantId = auth.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: 'staff.team_member',\n        resourceId: auth.sub,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const selfInput: StaffTeamMemberCreateInput = {\n      ...parsed,\n      userId: auth.sub,\n      teamId: null,\n      roleIds: [],\n      tags: [],\n      availabilityRuleSetId: null,\n      isActive: true,\n    }\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberCreateInput, { memberId: string }>(\n      'staff.team-members.create',\n      {\n        input: selfInput,\n        ctx,\n      },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? auth.sub,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.team_member',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.self.create failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.form.errors.create', 'Failed to create team member.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Self team member profile',\n  methods: {\n    GET: {\n      summary: 'Get current user team member profile',\n      description: 'Returns the staff team member linked to the current user, if any.',\n      responses: [\n        { status: 200, description: 'Team member profile', schema: selfMemberResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    POST: {\n      summary: 'Create current user team member profile',\n      description: 'Creates a team member profile for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberSelfCreateSchema,\n      },\n      responses: [\n        { status: 201, description: 'Team member created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Already exists', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AAEtC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC5E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,aAAa,EAAE,OAAO;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,aAAa,GAAG;AACtC,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,IAAK,QAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AACzD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MACpC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AACtD,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,aAAa,OAAO;AAAA,QACpB,QAAQ,OAAO,UAAU;AAAA,QACzB,QAAQ,OAAO,UAAU;AAAA,QACzB,uBAAuB,OAAO,yBAAyB;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC3C;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAC9G,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAC5F,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MACpC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IACxF;AACA,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,qCAAqC,EAAE,CAAC;AAAA,IAC3H;AAEA,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,YAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,MACb,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,MAAM,CAAC;AAAA,MACP,uBAAuB;AAAA,MACvB,UAAU;AAAA,IACZ;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,KAAK;AAAA,QACrC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,yBAAyB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC1G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandRuntimeContext, CommandBus } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { StaffTeamMember } from '../../../data/entities'\nimport {\n  staffTeamMemberSelfCreateSchema,\n  type StaffTeamMemberSelfCreateInput,\n  type StaffTeamMemberCreateInput,\n} from '../../../data/validators'\nimport {\n  runStaffMutationGuardAfterSuccess,\n  runStaffMutationGuards,\n} from '../../guards'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('staff')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['staff.leave_requests.send'] },\n  POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.send'] },\n}\n\nasync function buildContext(\n  req: Request\n): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return { ctx, translate }\n}\n\nconst selfMemberResponseSchema = z.object({\n  member: z\n    .object({\n      id: z.string().uuid(),\n      displayName: z.string(),\n      userId: z.string().uuid().nullable(),\n      teamId: z.string().uuid().nullable(),\n      availabilityRuleSetId: z.string().uuid().nullable(),\n    })\n    .nullable(),\n})\n\nexport async function GET(req: Request) {\n  try {\n    const { ctx } = await buildContext(req)\n    const auth = ctx.auth\n    if (!auth?.sub) return NextResponse.json({ member: null })\n    const em = (ctx.container.resolve('em') as any)\n    const member = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    if (!member) return NextResponse.json({ member: null })\n    return NextResponse.json({\n      member: {\n        id: member.id,\n        displayName: member.displayName,\n        userId: member.userId ?? null,\n        teamId: member.teamId ?? null,\n        availabilityRuleSetId: member.availabilityRuleSetId ?? null,\n      },\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('staff.teamMembers.self.load failed', { err })\n    return NextResponse.json({ member: null })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, translate } = await buildContext(req)\n    const auth = ctx.auth\n    if (!auth?.sub) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })\n    const body = await req.json().catch(() => ({}))\n    const parsed = parseScopedCommandInput(staffTeamMemberSelfCreateSchema, body, ctx, translate)\n    const em = (ctx.container.resolve('em') as any)\n    const existing = await findOneWithDecryption(\n      em,\n      StaffTeamMember,\n      { userId: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: ctx.selectedOrganizationId ?? null },\n    )\n    if (existing) {\n      throw new CrudHttpError(409, { error: translate('staff.teamMembers.self.exists', 'Team member profile already exists.') })\n    }\n\n    const tenantId = auth.tenantId ?? ''\n    const organizationId = ctx.selectedOrganizationId ?? null\n    const guardResult = await runStaffMutationGuards(\n      ctx.container,\n      {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: 'staff.team_member',\n        resourceId: auth.sub,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        mutationPayload: parsed,\n      },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(\n        guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n        { status: guardResult.errorStatus ?? 422 },\n      )\n    }\n\n    const commandBus = (ctx.container.resolve('commandBus') as CommandBus)\n    const selfInput: StaffTeamMemberCreateInput = {\n      ...parsed,\n      userId: auth.sub,\n      teamId: null,\n      roleIds: [],\n      tags: [],\n      availabilityRuleSetId: null,\n      isActive: true,\n    }\n    const { result, logEntry } = await commandBus.execute<StaffTeamMemberCreateInput, { memberId: string }>(\n      'staff.team-members.create',\n      {\n        input: selfInput,\n        ctx,\n      },\n    )\n\n    if (guardResult.afterSuccessCallbacks.length) {\n      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n        tenantId,\n        organizationId,\n        userId: auth.sub,\n        resourceKind: 'staff.team_member',\n        resourceId: result?.memberId ?? auth.sub,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n      })\n    }\n\n    const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'staff.team_member',\n          resourceId: logEntry.resourceId ?? result?.memberId ?? null,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('staff.teamMembers.self.create failed', { err })\n    return NextResponse.json({ error: translate('staff.teamMembers.form.errors.create', 'Failed to create team member.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Self team member profile',\n  methods: {\n    GET: {\n      summary: 'Get current user team member profile',\n      description: 'Returns the staff team member linked to the current user, if any.',\n      responses: [\n        { status: 200, description: 'Team member profile', schema: selfMemberResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    POST: {\n      summary: 'Create current user team member profile',\n      description: 'Creates a team member profile for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: staffTeamMemberSelfCreateSchema,\n      },\n      responses: [\n        { status: 201, description: 'Team member created', schema: z.object({ id: z.string().uuid().nullable() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Already exists', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,kCAAkC;AAE3C,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,6BAA6B;AAEtC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,OAAO;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC5E;AAEA,eAAe,aACb,KACgG;AAChG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AACzG,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IAC1E,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO,EAAE,KAAK,UAAU;AAC1B;AAEA,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,QAAQ,EACL,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,aAAa,EAAE,OAAO;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpD,CAAC,EACA,SAAS;AACd,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,IAAI,MAAM,aAAa,GAAG;AACtC,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,IAAK,QAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AACzD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MACpC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IACxF;AACA,QAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AACtD,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ;AAAA,QACN,IAAI,OAAO;AAAA,QACX,aAAa,OAAO;AAAA,QACpB,QAAQ,OAAO,UAAU;AAAA,QACzB,QAAQ,OAAO,UAAU;AAAA,QACzB,uBAAuB,OAAO,yBAAyB;AAAA,MACzD;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC3C;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,UAAU,IAAI,MAAM,aAAa,GAAG;AACjD,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,IAAK,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,cAAc,EAAE,CAAC;AAC9G,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,wBAAwB,iCAAiC,MAAM,KAAK,SAAS;AAC5F,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,MACpC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,IAAI,0BAA0B,KAAK;AAAA,IACxF;AACA,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,qCAAqC,EAAE,CAAC;AAAA,IAC3H;AAEA,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,iBAAiB,IAAI,0BAA0B;AACrD,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ;AAAA,QACE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,KAAK;AAAA,QACjB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,iBAAiB;AAAA,MACnB;AAAA,IACF;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa;AAAA,QAClB,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,QAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,aAAc,IAAI,UAAU,QAAQ,YAAY;AACtD,UAAM,YAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,QAAQ,KAAK;AAAA,MACb,QAAQ;AAAA,MACR,SAAS,CAAC;AAAA,MACV,MAAM,CAAC;AAAA,MACP,uBAAuB;AAAA,MACvB,UAAU;AAAA,IACZ;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAEA,QAAI,YAAY,sBAAsB,QAAQ;AAC5C,YAAM,kCAAkC,YAAY,uBAAuB;AAAA,QACzE;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,QAAQ,YAAY,KAAK;AAAA,QACrC,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,YAAY,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpF,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,QAAQ,YAAY;AAAA,UACvD,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wCAAwC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,yBAAyB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAC1G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/staff/api/team-members/tags/assign/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -30,7 +31,7 @@ async function buildContext(req) {
     container,
     auth,
     organizationScope: scope,
-    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,
     organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request: req
   };