@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/warranty_claims/api/vendor-recovery/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/vendor-recovery/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { vendorRecoveryInputSchema, type VendorRecoveryInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toVendorRecoveryInput(scopedPayload: Record<string, unknown>): VendorRecoveryInput {\n  return vendorRecoveryInputSchema.parse({\n    claimId: scopedPayload.claimId,\n    lineIds: scopedPayload.lineIds,\n    vendorName: scopedPayload.vendorName,\n    vendorRef: scopedPayload.vendorRef,\n  })\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: VendorRecoveryInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = withScopedPayload(payload, context.ctx, context.translate)\n    const input = toVendorRecoveryInput(scopedPayload)\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? toVendorRecoveryInput(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<VendorRecoveryInput, { claimId: string }>(\n      'warranty_claims.claim.create_vendor_recovery',\n      { input: commandInput, ctx: context.ctx },\n    )\n    const createdClaimId = result?.claimId\n    if (typeof createdClaimId !== 'string') {\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.notFound', 'Warranty claim not found.') })\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: createdClaimId })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.vendor-recovery.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create vendor recovery claim',\n  methods: {\n    POST: {\n      summary: 'Create a linked vendor-recovery claim from resolved source lines',\n      requestBody: { contentType: 'application/json', schema: vendorRecoveryInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Vendor recovery claim created',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,iCAA2D;AACpE,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAStC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,eAA6D;AAC1F,SAAO,0BAA0B,MAAM;AAAA,IACrC,SAAS,cAAc;AAAA,IACvB,SAAS,cAAc;AAAA,IACvB,YAAY,cAAc;AAAA,IAC1B,WAAW,cAAc;AAAA,EAC3B,CAAC;AACH;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS;AAC/E,UAAM,QAAQ,sBAAsB,aAAa;AACjD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,sBAAsB,QAAQ,eAAe,IAAI;AAEhG,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AACA,UAAM,iBAAiB,QAAQ;AAC/B,QAAI,OAAO,mBAAmB,UAAU;AACtC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,2BAA2B,EAAE,CAAC;AAAA,IAC3H;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,eAAe,CAAC;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { vendorRecoveryInputSchema, type VendorRecoveryInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toVendorRecoveryInput(scopedPayload: Record<string, unknown>): VendorRecoveryInput {\n  return vendorRecoveryInputSchema.parse({\n    claimId: scopedPayload.claimId,\n    lineIds: scopedPayload.lineIds,\n    vendorName: scopedPayload.vendorName,\n    vendorRef: scopedPayload.vendorRef,\n  })\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: VendorRecoveryInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = withScopedPayload(payload, context.ctx, context.translate)\n    const input = toVendorRecoveryInput(scopedPayload)\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? toVendorRecoveryInput(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<VendorRecoveryInput, { claimId: string }>(\n      'warranty_claims.claim.create_vendor_recovery',\n      { input: commandInput, ctx: context.ctx },\n    )\n    const createdClaimId = result?.claimId\n    if (typeof createdClaimId !== 'string') {\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.notFound', 'Warranty claim not found.') })\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: createdClaimId })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.vendor-recovery.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create vendor recovery claim',\n  methods: {\n    POST: {\n      summary: 'Create a linked vendor-recovery claim from resolved source lines',\n      requestBody: { contentType: 'application/json', schema: vendorRecoveryInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Vendor recovery claim created',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,iCAA2D;AACpE,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAStC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,eAA6D;AAC1F,SAAO,0BAA0B,MAAM;AAAA,IACrC,SAAS,cAAc;AAAA,IACvB,SAAS,cAAc;AAAA,IACvB,YAAY,cAAc;AAAA,IAC1B,WAAW,cAAc;AAAA,EAC3B,CAAC;AACH;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS;AAC/E,UAAM,QAAQ,sBAAsB,aAAa;AACjD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,sBAAsB,QAAQ,eAAe,IAAI;AAEhG,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AACA,UAAM,iBAAiB,QAAQ;AAC/B,QAAI,OAAO,mBAAmB,UAAU;AACtC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,2BAA2B,EAAE,CAAC;AAAA,IAC3H;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,eAAe,CAAC;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/vendor-recovery-suggestions/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -53,7 +54,7 @@ async function resolveSuggestionsContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }

package/dist/modules/warranty_claims/api/vendor-recovery-suggestions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/vendor-recovery-suggestions/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimLine, WarrantyVendorPolicy } from '../../data/entities'\nimport { requireScopedClaim, type WarrantyClaimScope } from '../../commands/shared'\nimport { findVendorRecoveryMatches } from '../../lib/vendorPolicyRecovery'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst querySchema = z.object({\n  claimId: z.string().uuid(),\n}).strict()\n\nconst suggestionSchema = z.object({\n  lineId: z.string().uuid(),\n  lineNo: z.number().int(),\n  productName: z.string().nullable(),\n  sku: z.string().nullable(),\n  vendorName: z.string(),\n  policyId: z.string().uuid(),\n  recoveryRatePct: z.string().nullable(),\n  causalFault: z.string().nullable(),\n  estimatedRecovery: z.string().nullable(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    claimId: z.string().uuid(),\n    suggestions: z.array(suggestionSchema),\n  }),\n})\n\ntype SuggestionsRouteContext = {\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toNullableString(value: number | string | null | undefined): string | null {\n  if (typeof value === 'number') return Number.isFinite(value) ? String(value) : null\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed ? trimmed : null\n}\n\nfunction toSuggestionVendorName(lineVendorName: string | null | undefined, policyVendorName: string): string {\n  const normalized = lineVendorName?.trim()\n  return normalized || policyVendorName\n}\n\nasync function resolveSuggestionsContext(req: Request): Promise<SuggestionsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveSuggestionsContext(req)\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    if (claim.claimType !== 'warranty' || (claim.status !== 'resolved' && claim.status !== 'closed')) {\n      return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions: [] } })\n    }\n\n    const lines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      {\n        claim: claim.id,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        lineStatus: 'resolved',\n        vendorClaimLineId: null,\n        deletedAt: null,\n      },\n      { orderBy: { lineNo: 'ASC' } },\n      context.scope,\n    )\n    const policies = await findWithDecryption(\n      context.em,\n      WarrantyVendorPolicy,\n      {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { vendorName: 'ASC', updatedAt: 'DESC' } },\n      context.scope,\n    )\n    const matches = findVendorRecoveryMatches({\n      claim,\n      lines,\n      policies,\n      requireWarrantyResolved: true,\n    })\n    const suggestions = matches.map((match) => ({\n      lineId: match.line.id,\n      lineNo: match.line.lineNo ?? 0,\n      productName: match.line.productName ?? null,\n      sku: match.line.sku ?? null,\n      vendorName: toSuggestionVendorName(match.line.vendorName, match.policy.vendorName),\n      policyId: match.policy.id,\n      recoveryRatePct: toNullableString(match.policy.recoveryRatePct),\n      causalFault: match.causalFault,\n      estimatedRecovery: match.estimatedRecovery,\n    }))\n    return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions } })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('[internal] warranty_claims.vendor-recovery-suggestions.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'List supplier recovery suggestions',\n  methods: {\n    GET: {\n      summary: 'List resolved warranty claim lines eligible for supplier recovery',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Supplier recovery suggestions',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAEpC,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,0BAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC,EAAE,OAAO;AAEV,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,aAAa,EAAE,MAAM,gBAAgB;AAAA,EACvC,CAAC;AACH,CAAC;AAUM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC9E;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI;AAC/E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,UAAU,UAAU;AAC7B;AAEA,SAAS,uBAAuB,gBAA2C,kBAAkC;AAC3G,QAAM,aAAa,gBAAgB,KAAK;AACxC,SAAO,cAAc;AACvB;AAEA,eAAe,0BAA0B,KAAgD;AACvF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACpE,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,QAAI,MAAM,cAAc,cAAe,MAAM,WAAW,cAAc,MAAM,WAAW,UAAW;AAChG,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;AAAA,IACvF;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,OAAO,MAAM;AAAA,QACb,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,mBAAmB;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,MAC7B,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,YAAY,OAAO,WAAW,OAAO,EAAE;AAAA,MACpD,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB;AAAA,IAC3B,CAAC;AACD,UAAM,cAAc,QAAQ,IAAI,CAAC,WAAW;AAAA,MAC1C,QAAQ,MAAM,KAAK;AAAA,MACnB,QAAQ,MAAM,KAAK,UAAU;AAAA,MAC7B,aAAa,MAAM,KAAK,eAAe;AAAA,MACvC,KAAK,MAAM,KAAK,OAAO;AAAA,MACvB,YAAY,uBAAuB,MAAM,KAAK,YAAY,MAAM,OAAO,UAAU;AAAA,MACjF,UAAU,MAAM,OAAO;AAAA,MACvB,iBAAiB,iBAAiB,MAAM,OAAO,eAAe;AAAA,MAC9D,aAAa,MAAM;AAAA,MACnB,mBAAmB,MAAM;AAAA,IAC3B,EAAE;AACF,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM,IAAI,YAAY,EAAE,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,qEAAqE,EAAE,IAAI,CAAC;AACzF,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimLine, WarrantyVendorPolicy } from '../../data/entities'\nimport { requireScopedClaim, type WarrantyClaimScope } from '../../commands/shared'\nimport { findVendorRecoveryMatches } from '../../lib/vendorPolicyRecovery'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst querySchema = z.object({\n  claimId: z.string().uuid(),\n}).strict()\n\nconst suggestionSchema = z.object({\n  lineId: z.string().uuid(),\n  lineNo: z.number().int(),\n  productName: z.string().nullable(),\n  sku: z.string().nullable(),\n  vendorName: z.string(),\n  policyId: z.string().uuid(),\n  recoveryRatePct: z.string().nullable(),\n  causalFault: z.string().nullable(),\n  estimatedRecovery: z.string().nullable(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    claimId: z.string().uuid(),\n    suggestions: z.array(suggestionSchema),\n  }),\n})\n\ntype SuggestionsRouteContext = {\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toNullableString(value: number | string | null | undefined): string | null {\n  if (typeof value === 'number') return Number.isFinite(value) ? String(value) : null\n  if (typeof value !== 'string') return null\n  const trimmed = value.trim()\n  return trimmed ? trimmed : null\n}\n\nfunction toSuggestionVendorName(lineVendorName: string | null | undefined, policyVendorName: string): string {\n  const normalized = lineVendorName?.trim()\n  return normalized || policyVendorName\n}\n\nasync function resolveSuggestionsContext(req: Request): Promise<SuggestionsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveSuggestionsContext(req)\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    if (claim.claimType !== 'warranty' || (claim.status !== 'resolved' && claim.status !== 'closed')) {\n      return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions: [] } })\n    }\n\n    const lines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      {\n        claim: claim.id,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        lineStatus: 'resolved',\n        vendorClaimLineId: null,\n        deletedAt: null,\n      },\n      { orderBy: { lineNo: 'ASC' } },\n      context.scope,\n    )\n    const policies = await findWithDecryption(\n      context.em,\n      WarrantyVendorPolicy,\n      {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { vendorName: 'ASC', updatedAt: 'DESC' } },\n      context.scope,\n    )\n    const matches = findVendorRecoveryMatches({\n      claim,\n      lines,\n      policies,\n      requireWarrantyResolved: true,\n    })\n    const suggestions = matches.map((match) => ({\n      lineId: match.line.id,\n      lineNo: match.line.lineNo ?? 0,\n      productName: match.line.productName ?? null,\n      sku: match.line.sku ?? null,\n      vendorName: toSuggestionVendorName(match.line.vendorName, match.policy.vendorName),\n      policyId: match.policy.id,\n      recoveryRatePct: toNullableString(match.policy.recoveryRatePct),\n      causalFault: match.causalFault,\n      estimatedRecovery: match.estimatedRecovery,\n    }))\n    return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions } })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('[internal] warranty_claims.vendor-recovery-suggestions.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'List supplier recovery suggestions',\n  methods: {\n    GET: {\n      summary: 'List resolved warranty claim lines eligible for supplier recovery',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Supplier recovery suggestions',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAEpC,SAAS,mBAAmB,4BAA4B;AACxD,SAAS,0BAAmD;AAC5D,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC,EAAE,OAAO;AAEV,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,EACrB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,aAAa,EAAE,MAAM,gBAAgB;AAAA,EACvC,CAAC;AACH,CAAC;AAUM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC9E;AAEA,SAAS,iBAAiB,OAA0D;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI;AAC/E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,UAAU,UAAU;AAC7B;AAEA,SAAS,uBAAuB,gBAA2C,kBAAkC;AAC3G,QAAM,aAAa,gBAAgB,KAAK;AACxC,SAAO,cAAc;AACvB;AAEA,eAAe,0BAA0B,KAAgD;AACvF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACpE,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,QAAI,MAAM,cAAc,cAAe,MAAM,WAAW,cAAc,MAAM,WAAW,UAAW;AAChG,aAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;AAAA,IACvF;AAEA,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,OAAO,MAAM;AAAA,QACb,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,YAAY;AAAA,QACZ,mBAAmB;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,MAC7B,QAAQ;AAAA,IACV;AACA,UAAM,WAAW,MAAM;AAAA,MACrB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,YAAY,OAAO,WAAW,OAAO,EAAE;AAAA,MACpD,QAAQ;AAAA,IACV;AACA,UAAM,UAAU,0BAA0B;AAAA,MACxC;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB;AAAA,IAC3B,CAAC;AACD,UAAM,cAAc,QAAQ,IAAI,CAAC,WAAW;AAAA,MAC1C,QAAQ,MAAM,KAAK;AAAA,MACnB,QAAQ,MAAM,KAAK,UAAU;AAAA,MAC7B,aAAa,MAAM,KAAK,eAAe;AAAA,MACvC,KAAK,MAAM,KAAK,OAAO;AAAA,MACvB,YAAY,uBAAuB,MAAM,KAAK,YAAY,MAAM,OAAO,UAAU;AAAA,MACjF,UAAU,MAAM,OAAO;AAAA,MACvB,iBAAiB,iBAAiB,MAAM,OAAO,eAAe;AAAA,MAC9D,aAAa,MAAM;AAAA,MACnB,mBAAmB,MAAM;AAAA,IAC3B,EAAE;AACF,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,EAAE,SAAS,MAAM,IAAI,YAAY,EAAE,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,qEAAqE,EAAE,IAAI,CAAC;AACzF,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/widgets/notifications/WarrantyClaimNotificationRenderer.js

@@ -121,7 +121,7 @@ function WarrantyClaimNotificationRenderer({
     notification.bodyVariables
   );
   const handleView = async () => {
-    if (!viewAction) {
+    if (!viewAction || notification.status === "actioned") {
       router.push(href);
       return;
     }

package/dist/modules/warranty_claims/widgets/notifications/WarrantyClaimNotificationRenderer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/widgets/notifications/WarrantyClaimNotificationRenderer.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport {\n  AlarmClock,\n  ClipboardCheck,\n  ExternalLink,\n  Loader2,\n  MessageSquare,\n  RefreshCw,\n  UserCheck,\n  X,\n  type LucideIcon,\n} from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { useLocale, useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\n\ntype ClaimNotificationType =\n  | 'warranty_claims.claim.submitted'\n  | 'warranty_claims.claim.assigned'\n  | 'warranty_claims.claim.status_changed'\n  | 'warranty_claims.claim.escalated'\n  | 'warranty_claims.claim.customer_replied'\n\ntype ClaimNotificationMeta = {\n  Icon: LucideIcon\n  titleKey: string\n  bodyKey: string\n  fallbackTitle: string\n  fallbackBody: string\n  tone: 'info' | 'warning'\n}\n\nconst notificationMeta: Record<ClaimNotificationType, ClaimNotificationMeta> = {\n  'warranty_claims.claim.submitted': {\n    Icon: ClipboardCheck,\n    titleKey: 'warranty_claims.notifications.submitted.title',\n    bodyKey: 'warranty_claims.notifications.submitted.body',\n    fallbackTitle: 'Claim submitted',\n    fallbackBody: 'A warranty claim has been submitted for review.',\n    tone: 'info',\n  },\n  'warranty_claims.claim.assigned': {\n    Icon: UserCheck,\n    titleKey: 'warranty_claims.notifications.assigned.title',\n    bodyKey: 'warranty_claims.notifications.assigned.body',\n    fallbackTitle: 'Claim assigned',\n    fallbackBody: 'A warranty claim has been assigned.',\n    tone: 'info',\n  },\n  'warranty_claims.claim.status_changed': {\n    Icon: RefreshCw,\n    titleKey: 'warranty_claims.notifications.statusChanged.title',\n    bodyKey: 'warranty_claims.notifications.statusChanged.body',\n    fallbackTitle: 'Claim status changed',\n    fallbackBody: 'A warranty claim status changed.',\n    tone: 'warning',\n  },\n  'warranty_claims.claim.escalated': {\n    Icon: AlarmClock,\n    titleKey: 'warranty_claims.notifications.escalated.title',\n    bodyKey: 'warranty_claims.notifications.escalated.body',\n    fallbackTitle: 'Claim escalated',\n    fallbackBody: 'A warranty claim has been escalated.',\n    tone: 'warning',\n  },\n  'warranty_claims.claim.customer_replied': {\n    Icon: MessageSquare,\n    titleKey: 'warranty_claims.notifications.customerReplied.title',\n    bodyKey: 'warranty_claims.notifications.customerReplied.body',\n    fallbackTitle: 'Customer replied',\n    fallbackBody: 'A customer replied on a warranty claim.',\n    tone: 'info',\n  },\n}\n\nconst toneClasses: Record<ClaimNotificationMeta['tone'], {\n  avatar: string\n  icon: string\n  border: string\n  unread: string\n}> = {\n  info: {\n    avatar: 'bg-status-info-bg',\n    icon: 'text-status-info-icon',\n    border: 'border-l-status-info-border',\n    unread: 'bg-status-info-bg',\n  },\n  warning: {\n    avatar: 'bg-status-warning-bg',\n    icon: 'text-status-warning-icon',\n    border: 'border-l-status-warning-border',\n    unread: 'bg-status-warning-bg',\n  },\n}\n\nfunction isClaimNotificationType(type: string): type is ClaimNotificationType {\n  return Object.prototype.hasOwnProperty.call(notificationMeta, type)\n}\n\nfunction getNotificationMeta(type: string): ClaimNotificationMeta {\n  return notificationMeta[isClaimNotificationType(type) ? type : 'warranty_claims.claim.submitted']\n}\n\nfunction fallbackText(value: string | null | undefined, key: string, fallback: string): string {\n  if (!value || value === key) return fallback\n  return value\n}\n\nfunction translateText(\n  t: TranslateFn,\n  key: string,\n  fallback: string,\n  variables: Record<string, string> | null | undefined,\n): string {\n  return t(key, fallback, variables ?? undefined)\n}\n\nfunction resolveClaimHref(notification: NotificationRendererProps['notification']): string {\n  if (notification.linkHref && !notification.linkHref.includes('{sourceEntityId}')) return notification.linkHref\n  if (notification.sourceEntityId) return `/backend/warranty_claims/${notification.sourceEntityId}`\n  return '/backend/warranty_claims'\n}\n\nexport function WarrantyClaimNotificationRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const meta = getNotificationMeta(notification.type)\n  const classes = toneClasses[meta.tone]\n  const isUnread = notification.status === 'unread'\n  const claimNumber = notification.bodyVariables?.claimNumber ?? notification.titleVariables?.claimNumber\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n  const href = resolveClaimHref(notification)\n  const timeAgo = formatRelativeTime(notification.createdAt, { locale }) ?? ''\n  const title = translateText(\n    t,\n    notification.titleKey ?? meta.titleKey,\n    fallbackText(notification.title, notification.titleKey ?? meta.titleKey, meta.fallbackTitle),\n    notification.titleVariables,\n  )\n  const body = translateText(\n    t,\n    notification.bodyKey ?? meta.bodyKey,\n    fallbackText(notification.body, notification.bodyKey ?? meta.bodyKey, meta.fallbackBody),\n    notification.bodyVariables,\n  )\n\n  const handleView = async () => {\n    if (!viewAction) {\n      router.push(href)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  return (\n    <div\n      className={cn(\n        'group relative flex items-start gap-3 rounded-xl border-l-4 p-3 transition-colors hover:bg-muted/40',\n        classes.border,\n        isUnread && classes.unread,\n      )}\n    >\n      <div className={cn('relative flex size-10 shrink-0 items-center justify-center rounded-full', classes.avatar)}>\n        <meta.Icon className={cn('size-5', classes.icon)} aria-hidden=\"true\" />\n        {isUnread ? (\n          <span\n            className=\"absolute -right-1 -top-1 size-3 rounded-full bg-accent-indigo ring-2 ring-background\"\n            aria-hidden=\"true\"\n          />\n        ) : null}\n      </div>\n\n      <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n        <p className=\"truncate text-sm font-medium leading-5 text-foreground\">{title}</p>\n        <div className=\"flex flex-wrap items-center gap-1 text-xs leading-4 text-muted-foreground\">\n          {timeAgo ? <span className=\"whitespace-nowrap\">{timeAgo}</span> : null}\n          {timeAgo && claimNumber ? <span aria-hidden=\"true\" className=\"text-text-disabled\">\u2014</span> : null}\n          {claimNumber ? (\n            <span className=\"inline-flex max-w-full items-center rounded bg-muted px-1.5 py-0.5 font-mono text-overline text-foreground\">\n              <span className=\"truncate\">#{claimNumber}</span>\n            </span>\n          ) : null}\n        </div>\n        {body ? (\n          <div className=\"mt-2 inline-flex max-w-full self-start rounded-tr-lg rounded-br-lg rounded-bl-lg rounded-tl-sm border border-border bg-background px-3 py-2 text-sm leading-5 text-muted-foreground shadow-xs\">\n            <p className=\"line-clamp-2 break-words\">{body}</p>\n          </div>\n        ) : null}\n        <div className=\"mt-2 flex flex-wrap items-center gap-2\">\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            className=\"gap-1.5\"\n            onClick={(event) => {\n              event.stopPropagation()\n              handleView()\n            }}\n            disabled={executing}\n          >\n            <ExternalLink className=\"size-4\" aria-hidden=\"true\" />\n            {t('common.view', 'View')}\n            {executing ? <Loader2 className=\"size-3 animate-spin\" aria-hidden=\"true\" /> : null}\n          </Button>\n          <Button\n            type=\"button\"\n            variant=\"ghost\"\n            size=\"sm\"\n            onClick={(event) => {\n              event.stopPropagation()\n              onDismiss()\n            }}\n          >\n            {t('notifications.actions.dismiss', 'Dismiss')}\n          </Button>\n        </div>\n      </div>\n\n      <IconButton\n        type=\"button\"\n        variant=\"ghost\"\n        size=\"xs\"\n        className=\"absolute right-2 top-2 opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100\"\n        onClick={(event) => {\n          event.stopPropagation()\n          onDismiss()\n        }}\n        aria-label={t('notifications.actions.dismiss', 'Dismiss')}\n      >\n        <X className=\"size-4\" aria-hidden=\"true\" />\n      </IconButton>\n    </div>\n  )\n}\n\nexport default WarrantyClaimNotificationRenderer\n"],
-  "mappings": ";AAoLM,SACE,KADF;AAlLN,YAAY,WAAW;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAA8B;AAClD,SAAS,0BAA0B;AACnC,SAAS,UAAU;AAmBnB,MAAM,mBAAyE;AAAA,EAC7E,mCAAmC;AAAA,IACjC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,kCAAkC;AAAA,IAChC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,wCAAwC;AAAA,IACtC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,mCAAmC;AAAA,IACjC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,0CAA0C;AAAA,IACxC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AACF;AAEA,MAAM,cAKD;AAAA,EACH,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,wBAAwB,MAA6C;AAC5E,SAAO,OAAO,UAAU,eAAe,KAAK,kBAAkB,IAAI;AACpE;AAEA,SAAS,oBAAoB,MAAqC;AAChE,SAAO,iBAAiB,wBAAwB,IAAI,IAAI,OAAO,iCAAiC;AAClG;AAEA,SAAS,aAAa,OAAkC,KAAa,UAA0B;AAC7F,MAAI,CAAC,SAAS,UAAU,IAAK,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,cACP,GACA,KACA,UACA,WACQ;AACR,SAAO,EAAE,KAAK,UAAU,aAAa,MAAS;AAChD;AAEA,SAAS,iBAAiB,cAAiE;AACzF,MAAI,aAAa,YAAY,CAAC,aAAa,SAAS,SAAS,kBAAkB,EAAG,QAAO,aAAa;AACtG,MAAI,aAAa,eAAgB,QAAO,4BAA4B,aAAa,cAAc;AAC/F,SAAO;AACT;AAEO,SAAS,kCAAkC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,OAAO,oBAAoB,aAAa,IAAI;AAClD,QAAM,UAAU,YAAY,KAAK,IAAI;AACrC,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AACnF,QAAM,OAAO,iBAAiB,YAAY;AAC1C,QAAM,UAAU,mBAAmB,aAAa,WAAW,EAAE,OAAO,CAAC,KAAK;AAC1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,aAAa,YAAY,KAAK;AAAA,IAC9B,aAAa,aAAa,OAAO,aAAa,YAAY,KAAK,UAAU,KAAK,aAAa;AAAA,IAC3F,aAAa;AAAA,EACf;AACA,QAAM,OAAO;AAAA,IACX;AAAA,IACA,aAAa,WAAW,KAAK;AAAA,IAC7B,aAAa,aAAa,MAAM,aAAa,WAAW,KAAK,SAAS,KAAK,YAAY;AAAA,IACvF,aAAa;AAAA,EACf;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,YAAY;AACf,aAAO,KAAK,IAAI;AAChB;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,YAAY,QAAQ;AAAA,MACtB;AAAA,MAEA;AAAA,6BAAC,SAAI,WAAW,GAAG,2EAA2E,QAAQ,MAAM,GAC1G;AAAA,8BAAC,KAAK,MAAL,EAAU,WAAW,GAAG,UAAU,QAAQ,IAAI,GAAG,eAAY,QAAO;AAAA,UACpE,WACC;AAAA,YAAC;AAAA;AAAA,cACC,WAAU;AAAA,cACV,eAAY;AAAA;AAAA,UACd,IACE;AAAA,WACN;AAAA,QAEA,qBAAC,SAAI,WAAU,sCACb;AAAA,8BAAC,OAAE,WAAU,0DAA0D,iBAAM;AAAA,UAC7E,qBAAC,SAAI,WAAU,6EACZ;AAAA,sBAAU,oBAAC,UAAK,WAAU,qBAAqB,mBAAQ,IAAU;AAAA,YACjE,WAAW,cAAc,oBAAC,UAAK,eAAY,QAAO,WAAU,sBAAqB,oBAAC,IAAU;AAAA,YAC5F,cACC,oBAAC,UAAK,WAAU,8GACd,+BAAC,UAAK,WAAU,YAAW;AAAA;AAAA,cAAE;AAAA,eAAY,GAC3C,IACE;AAAA,aACN;AAAA,UACC,OACC,oBAAC,SAAI,WAAU,iMACb,8BAAC,OAAE,WAAU,4BAA4B,gBAAK,GAChD,IACE;AAAA,UACJ,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,UAAU;AAClB,wBAAM,gBAAgB;AACtB,6BAAW;AAAA,gBACb;AAAA,gBACA,UAAU;AAAA,gBAEV;AAAA,sCAAC,gBAAa,WAAU,UAAS,eAAY,QAAO;AAAA,kBACnD,EAAE,eAAe,MAAM;AAAA,kBACvB,YAAY,oBAAC,WAAQ,WAAU,uBAAsB,eAAY,QAAO,IAAK;AAAA;AAAA;AAAA,YAChF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,SAAQ;AAAA,gBACR,MAAK;AAAA,gBACL,SAAS,CAAC,UAAU;AAClB,wBAAM,gBAAgB;AACtB,4BAAU;AAAA,gBACZ;AAAA,gBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,YAC/C;AAAA,aACF;AAAA,WACF;AAAA,QAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,CAAC,UAAU;AAClB,oBAAM,gBAAgB;AACtB,wBAAU;AAAA,YACZ;AAAA,YACA,cAAY,EAAE,iCAAiC,SAAS;AAAA,YAExD,8BAAC,KAAE,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,QAC3C;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,4CAAQ;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport {\n  AlarmClock,\n  ClipboardCheck,\n  ExternalLink,\n  Loader2,\n  MessageSquare,\n  RefreshCw,\n  UserCheck,\n  X,\n  type LucideIcon,\n} from 'lucide-react'\nimport { useRouter } from 'next/navigation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { useLocale, useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { formatRelativeTime } from '@open-mercato/shared/lib/time'\nimport { cn } from '@open-mercato/shared/lib/utils'\nimport type { NotificationRendererProps } from '@open-mercato/shared/modules/notifications/types'\n\ntype ClaimNotificationType =\n  | 'warranty_claims.claim.submitted'\n  | 'warranty_claims.claim.assigned'\n  | 'warranty_claims.claim.status_changed'\n  | 'warranty_claims.claim.escalated'\n  | 'warranty_claims.claim.customer_replied'\n\ntype ClaimNotificationMeta = {\n  Icon: LucideIcon\n  titleKey: string\n  bodyKey: string\n  fallbackTitle: string\n  fallbackBody: string\n  tone: 'info' | 'warning'\n}\n\nconst notificationMeta: Record<ClaimNotificationType, ClaimNotificationMeta> = {\n  'warranty_claims.claim.submitted': {\n    Icon: ClipboardCheck,\n    titleKey: 'warranty_claims.notifications.submitted.title',\n    bodyKey: 'warranty_claims.notifications.submitted.body',\n    fallbackTitle: 'Claim submitted',\n    fallbackBody: 'A warranty claim has been submitted for review.',\n    tone: 'info',\n  },\n  'warranty_claims.claim.assigned': {\n    Icon: UserCheck,\n    titleKey: 'warranty_claims.notifications.assigned.title',\n    bodyKey: 'warranty_claims.notifications.assigned.body',\n    fallbackTitle: 'Claim assigned',\n    fallbackBody: 'A warranty claim has been assigned.',\n    tone: 'info',\n  },\n  'warranty_claims.claim.status_changed': {\n    Icon: RefreshCw,\n    titleKey: 'warranty_claims.notifications.statusChanged.title',\n    bodyKey: 'warranty_claims.notifications.statusChanged.body',\n    fallbackTitle: 'Claim status changed',\n    fallbackBody: 'A warranty claim status changed.',\n    tone: 'warning',\n  },\n  'warranty_claims.claim.escalated': {\n    Icon: AlarmClock,\n    titleKey: 'warranty_claims.notifications.escalated.title',\n    bodyKey: 'warranty_claims.notifications.escalated.body',\n    fallbackTitle: 'Claim escalated',\n    fallbackBody: 'A warranty claim has been escalated.',\n    tone: 'warning',\n  },\n  'warranty_claims.claim.customer_replied': {\n    Icon: MessageSquare,\n    titleKey: 'warranty_claims.notifications.customerReplied.title',\n    bodyKey: 'warranty_claims.notifications.customerReplied.body',\n    fallbackTitle: 'Customer replied',\n    fallbackBody: 'A customer replied on a warranty claim.',\n    tone: 'info',\n  },\n}\n\nconst toneClasses: Record<ClaimNotificationMeta['tone'], {\n  avatar: string\n  icon: string\n  border: string\n  unread: string\n}> = {\n  info: {\n    avatar: 'bg-status-info-bg',\n    icon: 'text-status-info-icon',\n    border: 'border-l-status-info-border',\n    unread: 'bg-status-info-bg',\n  },\n  warning: {\n    avatar: 'bg-status-warning-bg',\n    icon: 'text-status-warning-icon',\n    border: 'border-l-status-warning-border',\n    unread: 'bg-status-warning-bg',\n  },\n}\n\nfunction isClaimNotificationType(type: string): type is ClaimNotificationType {\n  return Object.prototype.hasOwnProperty.call(notificationMeta, type)\n}\n\nfunction getNotificationMeta(type: string): ClaimNotificationMeta {\n  return notificationMeta[isClaimNotificationType(type) ? type : 'warranty_claims.claim.submitted']\n}\n\nfunction fallbackText(value: string | null | undefined, key: string, fallback: string): string {\n  if (!value || value === key) return fallback\n  return value\n}\n\nfunction translateText(\n  t: TranslateFn,\n  key: string,\n  fallback: string,\n  variables: Record<string, string> | null | undefined,\n): string {\n  return t(key, fallback, variables ?? undefined)\n}\n\nfunction resolveClaimHref(notification: NotificationRendererProps['notification']): string {\n  if (notification.linkHref && !notification.linkHref.includes('{sourceEntityId}')) return notification.linkHref\n  if (notification.sourceEntityId) return `/backend/warranty_claims/${notification.sourceEntityId}`\n  return '/backend/warranty_claims'\n}\n\nexport function WarrantyClaimNotificationRenderer({\n  notification,\n  onAction,\n  onDismiss,\n  actions = [],\n}: NotificationRendererProps) {\n  const t = useT()\n  const locale = useLocale()\n  const router = useRouter()\n  const [executing, setExecuting] = React.useState(false)\n  const meta = getNotificationMeta(notification.type)\n  const classes = toneClasses[meta.tone]\n  const isUnread = notification.status === 'unread'\n  const claimNumber = notification.bodyVariables?.claimNumber ?? notification.titleVariables?.claimNumber\n  const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null\n  const href = resolveClaimHref(notification)\n  const timeAgo = formatRelativeTime(notification.createdAt, { locale }) ?? ''\n  const title = translateText(\n    t,\n    notification.titleKey ?? meta.titleKey,\n    fallbackText(notification.title, notification.titleKey ?? meta.titleKey, meta.fallbackTitle),\n    notification.titleVariables,\n  )\n  const body = translateText(\n    t,\n    notification.bodyKey ?? meta.bodyKey,\n    fallbackText(notification.body, notification.bodyKey ?? meta.bodyKey, meta.fallbackBody),\n    notification.bodyVariables,\n  )\n\n  const handleView = async () => {\n    if (!viewAction || notification.status === 'actioned') {\n      router.push(href)\n      return\n    }\n    setExecuting(true)\n    try {\n      await onAction(viewAction.id)\n    } finally {\n      setExecuting(false)\n    }\n  }\n\n  return (\n    <div\n      className={cn(\n        'group relative flex items-start gap-3 rounded-xl border-l-4 p-3 transition-colors hover:bg-muted/40',\n        classes.border,\n        isUnread && classes.unread,\n      )}\n    >\n      <div className={cn('relative flex size-10 shrink-0 items-center justify-center rounded-full', classes.avatar)}>\n        <meta.Icon className={cn('size-5', classes.icon)} aria-hidden=\"true\" />\n        {isUnread ? (\n          <span\n            className=\"absolute -right-1 -top-1 size-3 rounded-full bg-accent-indigo ring-2 ring-background\"\n            aria-hidden=\"true\"\n          />\n        ) : null}\n      </div>\n\n      <div className=\"flex min-w-0 flex-1 flex-col gap-1\">\n        <p className=\"truncate text-sm font-medium leading-5 text-foreground\">{title}</p>\n        <div className=\"flex flex-wrap items-center gap-1 text-xs leading-4 text-muted-foreground\">\n          {timeAgo ? <span className=\"whitespace-nowrap\">{timeAgo}</span> : null}\n          {timeAgo && claimNumber ? <span aria-hidden=\"true\" className=\"text-text-disabled\">\u2014</span> : null}\n          {claimNumber ? (\n            <span className=\"inline-flex max-w-full items-center rounded bg-muted px-1.5 py-0.5 font-mono text-overline text-foreground\">\n              <span className=\"truncate\">#{claimNumber}</span>\n            </span>\n          ) : null}\n        </div>\n        {body ? (\n          <div className=\"mt-2 inline-flex max-w-full self-start rounded-tr-lg rounded-br-lg rounded-bl-lg rounded-tl-sm border border-border bg-background px-3 py-2 text-sm leading-5 text-muted-foreground shadow-xs\">\n            <p className=\"line-clamp-2 break-words\">{body}</p>\n          </div>\n        ) : null}\n        <div className=\"mt-2 flex flex-wrap items-center gap-2\">\n          <Button\n            type=\"button\"\n            size=\"sm\"\n            className=\"gap-1.5\"\n            onClick={(event) => {\n              event.stopPropagation()\n              handleView()\n            }}\n            disabled={executing}\n          >\n            <ExternalLink className=\"size-4\" aria-hidden=\"true\" />\n            {t('common.view', 'View')}\n            {executing ? <Loader2 className=\"size-3 animate-spin\" aria-hidden=\"true\" /> : null}\n          </Button>\n          <Button\n            type=\"button\"\n            variant=\"ghost\"\n            size=\"sm\"\n            onClick={(event) => {\n              event.stopPropagation()\n              onDismiss()\n            }}\n          >\n            {t('notifications.actions.dismiss', 'Dismiss')}\n          </Button>\n        </div>\n      </div>\n\n      <IconButton\n        type=\"button\"\n        variant=\"ghost\"\n        size=\"xs\"\n        className=\"absolute right-2 top-2 opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100\"\n        onClick={(event) => {\n          event.stopPropagation()\n          onDismiss()\n        }}\n        aria-label={t('notifications.actions.dismiss', 'Dismiss')}\n      >\n        <X className=\"size-4\" aria-hidden=\"true\" />\n      </IconButton>\n    </div>\n  )\n}\n\nexport default WarrantyClaimNotificationRenderer\n"],
+  "mappings": ";AAoLM,SACE,KADF;AAlLN,YAAY,WAAW;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,iBAAiB;AAC1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAA8B;AAClD,SAAS,0BAA0B;AACnC,SAAS,UAAU;AAmBnB,MAAM,mBAAyE;AAAA,EAC7E,mCAAmC;AAAA,IACjC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,kCAAkC;AAAA,IAChC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,wCAAwC;AAAA,IACtC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,mCAAmC;AAAA,IACjC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AAAA,EACA,0CAA0C;AAAA,IACxC,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,IACT,eAAe;AAAA,IACf,cAAc;AAAA,IACd,MAAM;AAAA,EACR;AACF;AAEA,MAAM,cAKD;AAAA,EACH,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,wBAAwB,MAA6C;AAC5E,SAAO,OAAO,UAAU,eAAe,KAAK,kBAAkB,IAAI;AACpE;AAEA,SAAS,oBAAoB,MAAqC;AAChE,SAAO,iBAAiB,wBAAwB,IAAI,IAAI,OAAO,iCAAiC;AAClG;AAEA,SAAS,aAAa,OAAkC,KAAa,UAA0B;AAC7F,MAAI,CAAC,SAAS,UAAU,IAAK,QAAO;AACpC,SAAO;AACT;AAEA,SAAS,cACP,GACA,KACA,UACA,WACQ;AACR,SAAO,EAAE,KAAK,UAAU,aAAa,MAAS;AAChD;AAEA,SAAS,iBAAiB,cAAiE;AACzF,MAAI,aAAa,YAAY,CAAC,aAAa,SAAS,SAAS,kBAAkB,EAAG,QAAO,aAAa;AACtG,MAAI,aAAa,eAAgB,QAAO,4BAA4B,aAAa,cAAc;AAC/F,SAAO;AACT;AAEO,SAAS,kCAAkC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AACb,GAA8B;AAC5B,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,OAAO,oBAAoB,aAAa,IAAI;AAClD,QAAM,UAAU,YAAY,KAAK,IAAI;AACrC,QAAM,WAAW,aAAa,WAAW;AACzC,QAAM,cAAc,aAAa,eAAe,eAAe,aAAa,gBAAgB;AAC5F,QAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,KAAK;AACnF,QAAM,OAAO,iBAAiB,YAAY;AAC1C,QAAM,UAAU,mBAAmB,aAAa,WAAW,EAAE,OAAO,CAAC,KAAK;AAC1E,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,aAAa,YAAY,KAAK;AAAA,IAC9B,aAAa,aAAa,OAAO,aAAa,YAAY,KAAK,UAAU,KAAK,aAAa;AAAA,IAC3F,aAAa;AAAA,EACf;AACA,QAAM,OAAO;AAAA,IACX;AAAA,IACA,aAAa,WAAW,KAAK;AAAA,IAC7B,aAAa,aAAa,MAAM,aAAa,WAAW,KAAK,SAAS,KAAK,YAAY;AAAA,IACvF,aAAa;AAAA,EACf;AAEA,QAAM,aAAa,YAAY;AAC7B,QAAI,CAAC,cAAc,aAAa,WAAW,YAAY;AACrD,aAAO,KAAK,IAAI;AAChB;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,SAAS,WAAW,EAAE;AAAA,IAC9B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW;AAAA,QACT;AAAA,QACA,QAAQ;AAAA,QACR,YAAY,QAAQ;AAAA,MACtB;AAAA,MAEA;AAAA,6BAAC,SAAI,WAAW,GAAG,2EAA2E,QAAQ,MAAM,GAC1G;AAAA,8BAAC,KAAK,MAAL,EAAU,WAAW,GAAG,UAAU,QAAQ,IAAI,GAAG,eAAY,QAAO;AAAA,UACpE,WACC;AAAA,YAAC;AAAA;AAAA,cACC,WAAU;AAAA,cACV,eAAY;AAAA;AAAA,UACd,IACE;AAAA,WACN;AAAA,QAEA,qBAAC,SAAI,WAAU,sCACb;AAAA,8BAAC,OAAE,WAAU,0DAA0D,iBAAM;AAAA,UAC7E,qBAAC,SAAI,WAAU,6EACZ;AAAA,sBAAU,oBAAC,UAAK,WAAU,qBAAqB,mBAAQ,IAAU;AAAA,YACjE,WAAW,cAAc,oBAAC,UAAK,eAAY,QAAO,WAAU,sBAAqB,oBAAC,IAAU;AAAA,YAC5F,cACC,oBAAC,UAAK,WAAU,8GACd,+BAAC,UAAK,WAAU,YAAW;AAAA;AAAA,cAAE;AAAA,eAAY,GAC3C,IACE;AAAA,aACN;AAAA,UACC,OACC,oBAAC,SAAI,WAAU,iMACb,8BAAC,OAAE,WAAU,4BAA4B,gBAAK,GAChD,IACE;AAAA,UACJ,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,MAAK;AAAA,gBACL,WAAU;AAAA,gBACV,SAAS,CAAC,UAAU;AAClB,wBAAM,gBAAgB;AACtB,6BAAW;AAAA,gBACb;AAAA,gBACA,UAAU;AAAA,gBAEV;AAAA,sCAAC,gBAAa,WAAU,UAAS,eAAY,QAAO;AAAA,kBACnD,EAAE,eAAe,MAAM;AAAA,kBACvB,YAAY,oBAAC,WAAQ,WAAU,uBAAsB,eAAY,QAAO,IAAK;AAAA;AAAA;AAAA,YAChF;AAAA,YACA;AAAA,cAAC;AAAA;AAAA,gBACC,MAAK;AAAA,gBACL,SAAQ;AAAA,gBACR,MAAK;AAAA,gBACL,SAAS,CAAC,UAAU;AAClB,wBAAM,gBAAgB;AACtB,4BAAU;AAAA,gBACZ;AAAA,gBAEC,YAAE,iCAAiC,SAAS;AAAA;AAAA,YAC/C;AAAA,aACF;AAAA,WACF;AAAA,QAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,CAAC,UAAU;AAClB,oBAAM,gBAAgB;AACtB,wBAAU;AAAA,YACZ;AAAA,YACA,cAAY,EAAE,iCAAiC,SAAS;AAAA,YAExD,8BAAC,KAAE,WAAU,UAAS,eAAY,QAAO;AAAA;AAAA,QAC3C;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,IAAO,4CAAQ;",
   "names": []
 }

package/dist/modules/wms/api/dashboard/operational/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import {
@@ -31,7 +32,7 @@ async function GET(request) {
       auth,
       request
     });
-    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
     if (!organizationId) {
       throw new CrudHttpError(401, { error: "Unauthorized" });
     }

package/dist/modules/wms/api/dashboard/operational/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/wms/api/dashboard/operational/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  operationalDashboardQuerySchema,\n  operationalDashboardResponseSchema,\n} from '../../../data/validators'\nimport {\n  loadOperationalDashboard,\n  OperationalDashboardWarehouseNotFoundError,\n} from '../../../lib/loadOperationalDashboard'\n\nconst logger = createLogger('wms')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n}\n\nexport async function GET(request: Request) {\n  try {\n    const url = new URL(request.url)\n    const parsedQuery = operationalDashboardQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request,\n    })\n    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const payload = await loadOperationalDashboard(em, {\n      organizationId,\n      tenantId: auth.tenantId,\n      warehouseId: parsedQuery.warehouseId ?? null,\n    })\n\n    return NextResponse.json(operationalDashboardResponseSchema.parse(payload))\n  } catch (error) {\n    if (error instanceof OperationalDashboardWarehouseNotFoundError) {\n      return NextResponse.json({ error: 'Warehouse not found' }, { status: 404 })\n    }\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('GET operational dashboard failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Operational dashboard',\n  description:\n    'Aggregated KPIs, expiry watch lot rows (`expiryLots`), monthly movement trends, and recent activity for the WMS operational dashboard.',\n  methods: {\n    GET: {\n      summary: 'Load operational dashboard data',\n      query: operationalDashboardQuerySchema,\n      responses: [\n        { status: 200, description: 'Dashboard payload', schema: operationalDashboardResponseSchema },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Warehouse not found' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,KAAK;AAE1B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAC1D;AAEA,eAAsB,IAAI,SAAkB;AAC1C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,cAAc,gCAAgC,MAAM,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACxG,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,yBAAyB,IAAI;AAAA,MACjD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,aAAa,YAAY,eAAe;AAAA,IAC1C,CAAC;AAED,WAAO,aAAa,KAAK,mCAAmC,MAAM,OAAO,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,4CAA4C;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5E;AACA,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,mCAAmC;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  operationalDashboardQuerySchema,\n  operationalDashboardResponseSchema,\n} from '../../../data/validators'\nimport {\n  loadOperationalDashboard,\n  OperationalDashboardWarehouseNotFoundError,\n} from '../../../lib/loadOperationalDashboard'\n\nconst logger = createLogger('wms')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n}\n\nexport async function GET(request: Request) {\n  try {\n    const url = new URL(request.url)\n    const parsedQuery = operationalDashboardQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request,\n    })\n    const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n    if (!organizationId) {\n      throw new CrudHttpError(401, { error: 'Unauthorized' })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const payload = await loadOperationalDashboard(em, {\n      organizationId,\n      tenantId: auth.tenantId,\n      warehouseId: parsedQuery.warehouseId ?? null,\n    })\n\n    return NextResponse.json(operationalDashboardResponseSchema.parse(payload))\n  } catch (error) {\n    if (error instanceof OperationalDashboardWarehouseNotFoundError) {\n      return NextResponse.json({ error: 'Warehouse not found' }, { status: 404 })\n    }\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('GET operational dashboard failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Operational dashboard',\n  description:\n    'Aggregated KPIs, expiry watch lot rows (`expiryLots`), monthly movement trends, and recent activity for the WMS operational dashboard.',\n  methods: {\n    GET: {\n      summary: 'Load operational dashboard data',\n      query: operationalDashboardQuerySchema,\n      responses: [\n        { status: 200, description: 'Dashboard payload', schema: operationalDashboardResponseSchema },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Warehouse not found' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,KAAK;AAE1B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAC1D;AAEA,eAAsB,IAAI,SAAkB;AAC1C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,cAAc,gCAAgC,MAAM,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACxG,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,IACxD;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,UAAU,MAAM,yBAAyB,IAAI;AAAA,MACjD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,aAAa,YAAY,eAAe;AAAA,IAC1C,CAAC;AAED,WAAO,aAAa,KAAK,mCAAmC,MAAM,OAAO,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,4CAA4C;AAC/D,aAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5E;AACA,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,aACE;AAAA,EACF,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,mCAAmC;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/wms/api/inventory/cycle-count/route.js

@@ -39,6 +39,7 @@ const openApi = {
       errors: [
         { status: 400, description: "Validation failed", schema: errorSchema },
         { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 409, description: "Counted quantity is below reserved + allocated stock (insufficient_stock)", schema: errorSchema },
         { status: 422, description: "Invalid location", schema: errorSchema }
       ]
     }

package/dist/modules/wms/api/inventory/cycle-count/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/wms/api/inventory/cycle-count/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryCycleCountSchema } from '../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.cycle_count'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsCustomPostRoute({\n    request,\n    routePath: 'wms/inventory/cycle-count',\n    inputSchema: inventoryCycleCountSchema,\n    commandId: 'wms.inventory.cycleCount',\n    describeResource: (input) => ({\n      resourceKind: 'wms.inventory',\n      resourceId: `${input.warehouseId}:${input.locationId}:${input.catalogVariantId}`,\n    }),\n    mapSuccess: (result: { adjustmentDelta: string; movementId: string | null }) => ({\n      ok: true,\n      adjustmentDelta: result.adjustmentDelta,\n      movementId: result.movementId,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  adjustmentDelta: z.string(),\n  movementId: z.string().uuid().nullable(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Cycle count reconcile',\n  methods: {\n    POST: {\n      summary: 'Cycle count reconcile',\n      description: 'Reconciles a counted quantity against the current on-hand balance and appends a cycle-count movement when a delta exists.',\n      requestBody: { contentType: 'application/json', schema: inventoryCycleCountSchema },\n      responses: [{ status: 200, description: 'Cycle count reconciled', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 422, description: 'Invalid location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,iCAAiC;AAC1C,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAClE;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,0BAA0B;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,GAAG,MAAM,WAAW,IAAI,MAAM,UAAU,IAAI,MAAM,gBAAgB;AAAA,IAChF;AAAA,IACA,YAAY,CAAC,YAAoE;AAAA,MAC/E,IAAI;AAAA,MACJ,iBAAiB,OAAO;AAAA,MACxB,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,cAAc,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { inventoryCycleCountSchema } from '../../../data/validators'\nimport { executeWmsCustomPostRoute } from '../helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['wms.cycle_count'] },\n}\n\nexport async function POST(request: Request) {\n  return executeWmsCustomPostRoute({\n    request,\n    routePath: 'wms/inventory/cycle-count',\n    inputSchema: inventoryCycleCountSchema,\n    commandId: 'wms.inventory.cycleCount',\n    describeResource: (input) => ({\n      resourceKind: 'wms.inventory',\n      resourceId: `${input.warehouseId}:${input.locationId}:${input.catalogVariantId}`,\n    }),\n    mapSuccess: (result: { adjustmentDelta: string; movementId: string | null }) => ({\n      ok: true,\n      adjustmentDelta: result.adjustmentDelta,\n      movementId: result.movementId,\n    }),\n  })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  adjustmentDelta: z.string(),\n  movementId: z.string().uuid().nullable(),\n})\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Cycle count reconcile',\n  methods: {\n    POST: {\n      summary: 'Cycle count reconcile',\n      description: 'Reconciles a counted quantity against the current on-hand balance and appends a cycle-count movement when a delta exists.',\n      requestBody: { contentType: 'application/json', schema: inventoryCycleCountSchema },\n      responses: [{ status: 200, description: 'Cycle count reconciled', schema: successSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Counted quantity is below reserved + allocated stock (insufficient_stock)', schema: errorSchema },\n        { status: 422, description: 'Invalid location', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,iCAAiC;AAC1C,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAClE;AAEA,eAAsB,KAAK,SAAkB;AAC3C,SAAO,0BAA0B;AAAA,IAC/B;AAAA,IACA,WAAW;AAAA,IACX,aAAa;AAAA,IACb,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,GAAG,MAAM,WAAW,IAAI,MAAM,UAAU,IAAI,MAAM,gBAAgB;AAAA,IAChF;AAAA,IACA,YAAY,CAAC,YAAoE;AAAA,MAC/E,IAAI;AAAA,MACJ,iBAAiB,OAAO;AAAA,MACxB,YAAY,OAAO;AAAA,IACrB;AAAA,EACF,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,cAAc,CAAC;AAAA,MACzF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6EAA6E,QAAQ,YAAY;AAAA,QAC7H,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/wms/api/inventory/helpers.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -30,7 +31,7 @@ async function executeWmsCustomPostRoute(options) {
       container,
       auth,
       organizationScope,
-      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
       organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
       request: options.request
     };

package/dist/modules/wms/api/inventory/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/wms/api/inventory/helpers.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('wms')\n\ntype ResourceDescriptor = {\n  resourceKind: string\n  resourceId: string\n}\n\ntype ExecuteWmsCustomPostRouteOptions<TInput, TResult> = {\n  request: Request\n  routePath: string\n  inputSchema: z.ZodType<TInput>\n  commandId: string\n  describeResource: (input: TInput) => ResourceDescriptor\n  mapSuccess: (result: TResult) => Record<string, unknown>\n}\n\nexport async function executeWmsCustomPostRoute<TInput, TResult>(\n  options: ExecuteWmsCustomPostRouteOptions<TInput, TResult>,\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(options.request)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: options.request,\n    })\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: options.request,\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(options.request, {})\n    const parsed = options.inputSchema.parse(body)\n    const resource = options.describeResource(parsed)\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const execution = await commandBus.execute<TInput, TResult>(options.commandId, {\n      input: parsed,\n      ctx,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const responseBody = options.mapSuccess(execution.result)\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: container.resolve('em'),\n        container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('custom route failed', { routePath: options.routePath, commandId: options.commandId, err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,KAAK;AAgBjC,eAAsB,0BACpB,SACA;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,MACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS,QAAQ;AAAA,IACnB;AACA,UAAM,OAAO,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,YAAY,MAAM,IAAI;AAC7C,UAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,YAAY,MAAM,WAAW,QAAyB,QAAQ,WAAW;AAAA,MAC7E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,eAAe,QAAQ,WAAW,UAAU,MAAM;AACxD,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC1B;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,WAAW,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('wms')\n\ntype ResourceDescriptor = {\n  resourceKind: string\n  resourceId: string\n}\n\ntype ExecuteWmsCustomPostRouteOptions<TInput, TResult> = {\n  request: Request\n  routePath: string\n  inputSchema: z.ZodType<TInput>\n  commandId: string\n  describeResource: (input: TInput) => ResourceDescriptor\n  mapSuccess: (result: TResult) => Record<string, unknown>\n}\n\nexport async function executeWmsCustomPostRoute<TInput, TResult>(\n  options: ExecuteWmsCustomPostRouteOptions<TInput, TResult>,\n) {\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(options.request)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n    const organizationScope = await resolveOrganizationScopeForRequest({\n      container,\n      auth,\n      request: options.request,\n    })\n    const ctx: CommandRuntimeContext = {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: options.request,\n    }\n    const body = await readJsonSafe<Record<string, unknown>>(options.request, {})\n    const parsed = options.inputSchema.parse(body)\n    const resource = options.describeResource(parsed)\n    const guardResult = await validateCrudMutationGuard(container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const execution = await commandBus.execute<TInput, TResult>(options.commandId, {\n      input: parsed,\n      ctx,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    const responseBody = options.mapSuccess(execution.result)\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: container.resolve('em'),\n        container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('custom route failed', { routePath: options.routePath, commandId: options.commandId, err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,KAAK;AAgBjC,eAAsB,0BACpB,SACA;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,QAAQ,OAAO;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AACA,UAAM,oBAAoB,MAAM,mCAAmC;AAAA,MACjE;AAAA,MACA;AAAA,MACA,SAAS,QAAQ;AAAA,IACnB,CAAC;AACD,UAAM,MAA6B;AAAA,MACjC;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,MACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS,QAAQ;AAAA,IACnB;AACA,UAAM,OAAO,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC;AAC5E,UAAM,SAAS,QAAQ,YAAY,MAAM,IAAI;AAC7C,UAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,UAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,MAC7D,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,YAAY,MAAM,WAAW,QAAyB,QAAQ,WAAW;AAAA,MAC7E,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,UAAM,eAAe,QAAQ,WAAW,UAAU,MAAM;AACxD,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC1B;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,uBAAuB,EAAE,WAAW,QAAQ,WAAW,WAAW,QAAQ,WAAW,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;",
   "names": []
 }

package/dist/modules/wms/api/inventory/import/helpers.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -52,7 +53,7 @@ async function buildImportContext(request) {
     container,
     auth,
     organizationScope,
-    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
     organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request
   };

package/dist/modules/wms/api/inventory/import/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/wms/api/inventory/import/helpers.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { parseInventoryImportCsv } from '../../../lib/inventoryImportCsv'\nimport { applyInventoryImport, validateInventoryImport } from '../../../lib/inventoryImportService'\nimport {\n  inventoryImportApplySchema,\n  inventoryImportValidateSchema,\n} from '../../../data/validators'\n\nconst logger = createLogger('wms')\n\ntype ImportRouteOptions = {\n  request: Request\n  routePath: string\n  mode: 'validate' | 'apply'\n}\n\n/**\n * Fail-closed scope guard for inventory import payloads. Unlike the shared\n * `ensureOrganizationScope` (which short-circuits for tenant-wide admins with\n * `allowedIds === null`), this rejects payloads whose `organizationId`/`tenantId`\n * fall outside the caller's actively selected scope so cross-organization imports\n * cannot be smuggled through the request body.\n */\nfunction assertImportScope(\n  ctx: CommandRuntimeContext,\n  input: { organizationId: string; tenantId: string },\n  translate: (key: string, fallback?: string) => string,\n): void {\n  const forbidden = () =>\n    new CrudHttpError(403, { error: translate('wms.errors.forbidden', 'Forbidden') })\n  if (ctx.auth?.isSuperAdmin === true) return\n\n  const actorTenantId = ctx.auth?.tenantId ?? null\n  if (!actorTenantId || actorTenantId !== input.tenantId) {\n    throw forbidden()\n  }\n\n  const allowedIds = ctx.organizationScope?.allowedIds ?? null\n  if (Array.isArray(allowedIds)) {\n    if (!allowedIds.includes(input.organizationId)) throw forbidden()\n    return\n  }\n\n  const selectedOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!selectedOrganizationId || selectedOrganizationId !== input.organizationId) {\n    throw forbidden()\n  }\n}\n\nasync function buildImportContext(request: Request): Promise<CommandRuntimeContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(request)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request,\n  })\n  return {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request,\n  }\n}\n\nasync function parseValidatePayload(request: Request): Promise<z.infer<typeof inventoryImportValidateSchema>> {\n  const { translate } = await resolveTranslations()\n  const contentType = request.headers.get('content-type') ?? ''\n  if (contentType.includes('multipart/form-data')) {\n    const formData = await request.formData()\n    const organizationId = String(formData.get('organizationId') ?? '').trim()\n    const tenantId = String(formData.get('tenantId') ?? '').trim()\n    const importBatchIdRaw = String(formData.get('importBatchId') ?? '').trim()\n    const skipDuplicatesRaw = String(formData.get('skipDuplicates') ?? '').trim()\n    const modeRaw = String(formData.get('mode') ?? '').trim()\n    const file = formData.get('file')\n    if (!(file instanceof File)) {\n      throw new CrudHttpError(400, {\n        error: translate('wms.backend.inventory.import.errors.csvFileRequired', 'CSV file is required.'),\n      })\n    }\n    const csvText = await file.text()\n    const rows = parseInventoryImportCsv(csvText)\n    return inventoryImportValidateSchema.parse({\n      organizationId,\n      tenantId,\n      ...(importBatchIdRaw ? { importBatchId: importBatchIdRaw } : {}),\n      ...(skipDuplicatesRaw ? { skipDuplicates: skipDuplicatesRaw === 'true' } : {}),\n      ...(modeRaw ? { mode: modeRaw } : {}),\n      rows,\n    })\n  }\n\n  const body = (await readJsonSafe<Record<string, unknown>>(request, {})) ?? {}\n  if (typeof body.csv === 'string' && body.csv.trim().length > 0) {\n    const rows = parseInventoryImportCsv(body.csv)\n    return inventoryImportValidateSchema.parse({\n      ...body,\n      rows,\n    })\n  }\n  return inventoryImportValidateSchema.parse(body)\n}\n\nexport async function executeWmsInventoryImportRoute(options: ImportRouteOptions) {\n  const { translate } = await resolveTranslations()\n  try {\n    const ctx = await buildImportContext(options.request)\n    const auth = ctx.auth\n    if (!auth?.tenantId || !auth.sub) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n\n    if (options.mode === 'validate') {\n      const parsed = await parseValidatePayload(options.request)\n      assertImportScope(ctx, parsed, translate)\n      const result = await validateInventoryImport(ctx, parsed)\n      return NextResponse.json(result)\n    }\n\n    const parsed = inventoryImportApplySchema.parse(\n      (await readJsonSafe<Record<string, unknown>>(options.request, {})) ?? {},\n    )\n    assertImportScope(ctx, parsed, translate)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: 'wms.inventory',\n      resourceId: parsed.importBatchId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const result = await applyInventoryImport(ctx, {\n      ...parsed,\n      performedBy: auth.sub,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: 'wms.inventory',\n        resourceId: parsed.importBatchId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: result as Record<string, unknown>,\n        headers: {},\n      },\n      context: {\n        em: ctx.container.resolve('em'),\n        container: ctx.container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate('wms.backend.inventory.import.errors.validationFailed', 'Validation failed.'),\n          details: error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('inventory import route failed', { routePath: options.routePath, mode: options.mode, err: error })\n    return NextResponse.json(\n      { error: translate('wms.errors.internalServerError', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,+BAA+B;AACxC,SAAS,sBAAsB,+BAA+B;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,KAAK;AAejC,SAAS,kBACP,KACA,OACA,WACM;AACN,QAAM,YAAY,MAChB,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,CAAC;AAClF,MAAI,IAAI,MAAM,iBAAiB,KAAM;AAErC,QAAM,gBAAgB,IAAI,MAAM,YAAY;AAC5C,MAAI,CAAC,iBAAiB,kBAAkB,MAAM,UAAU;AACtD,UAAM,UAAU;AAAA,EAClB;AAEA,QAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,QAAI,CAAC,WAAW,SAAS,MAAM,cAAc,EAAG,OAAM,UAAU;AAChE;AAAA,EACF;AAEA,QAAM,yBAAyB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAChF,MAAI,CAAC,0BAA0B,2BAA2B,MAAM,gBAAgB;AAC9E,UAAM,UAAU;AAAA,EAClB;AACF;AAEA,eAAe,mBAAmB,SAAkD;AAClF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,EAC9F;AACA,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,IACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,SAA0E;AAC5G,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,WAAW,MAAM,QAAQ,SAAS;AACxC,UAAM,iBAAiB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AACzE,UAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,KAAK;AAC7D,UAAM,mBAAmB,OAAO,SAAS,IAAI,eAAe,KAAK,EAAE,EAAE,KAAK;AAC1E,UAAM,oBAAoB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AAC5E,UAAM,UAAU,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACxD,UAAM,OAAO,SAAS,IAAI,MAAM;AAChC,QAAI,EAAE,gBAAgB,OAAO;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uDAAuD,uBAAuB;AAAA,MACjG,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAM,OAAO,wBAAwB,OAAO;AAC5C,WAAO,8BAA8B,MAAM;AAAA,MACzC;AAAA,MACA;AAAA,MACA,GAAI,mBAAmB,EAAE,eAAe,iBAAiB,IAAI,CAAC;AAAA,MAC9D,GAAI,oBAAoB,EAAE,gBAAgB,sBAAsB,OAAO,IAAI,CAAC;AAAA,MAC5E,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,OAAQ,MAAM,aAAsC,SAAS,CAAC,CAAC,KAAM,CAAC;AAC5E,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,GAAG;AAC9D,UAAM,OAAO,wBAAwB,KAAK,GAAG;AAC7C,WAAO,8BAA8B,MAAM;AAAA,MACzC,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,8BAA8B,MAAM,IAAI;AACjD;AAEA,eAAsB,+BAA+B,SAA6B;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,MAAM,MAAM,mBAAmB,QAAQ,OAAO;AACpD,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,YAAY,CAAC,KAAK,KAAK;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS,YAAY;AAC/B,YAAMA,UAAS,MAAM,qBAAqB,QAAQ,OAAO;AACzD,wBAAkB,KAAKA,SAAQ,SAAS;AACxC,YAAMC,UAAS,MAAM,wBAAwB,KAAKD,OAAM;AACxD,aAAO,aAAa,KAAKC,OAAM;AAAA,IACjC;AAEA,UAAM,SAAS,2BAA2B;AAAA,MACvC,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC,KAAM,CAAC;AAAA,IACzE;AACA,sBAAkB,KAAK,QAAQ,SAAS;AACxC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,qBAAqB,KAAK;AAAA,MAC7C,GAAG;AAAA,MACH,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC9B,WAAW,IAAI;AAAA,QACf,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,wDAAwD,oBAAoB;AAAA,UAC7F,SAAS,MAAM;AAAA,QACjB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,iCAAiC,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,uBAAuB,EAAE;AAAA,MAC9E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { parseInventoryImportCsv } from '../../../lib/inventoryImportCsv'\nimport { applyInventoryImport, validateInventoryImport } from '../../../lib/inventoryImportService'\nimport {\n  inventoryImportApplySchema,\n  inventoryImportValidateSchema,\n} from '../../../data/validators'\n\nconst logger = createLogger('wms')\n\ntype ImportRouteOptions = {\n  request: Request\n  routePath: string\n  mode: 'validate' | 'apply'\n}\n\n/**\n * Fail-closed scope guard for inventory import payloads. Unlike the shared\n * `ensureOrganizationScope` (which short-circuits for tenant-wide admins with\n * `allowedIds === null`), this rejects payloads whose `organizationId`/`tenantId`\n * fall outside the caller's actively selected scope so cross-organization imports\n * cannot be smuggled through the request body.\n */\nfunction assertImportScope(\n  ctx: CommandRuntimeContext,\n  input: { organizationId: string; tenantId: string },\n  translate: (key: string, fallback?: string) => string,\n): void {\n  const forbidden = () =>\n    new CrudHttpError(403, { error: translate('wms.errors.forbidden', 'Forbidden') })\n  if (ctx.auth?.isSuperAdmin === true) return\n\n  const actorTenantId = ctx.auth?.tenantId ?? null\n  if (!actorTenantId || actorTenantId !== input.tenantId) {\n    throw forbidden()\n  }\n\n  const allowedIds = ctx.organizationScope?.allowedIds ?? null\n  if (Array.isArray(allowedIds)) {\n    if (!allowedIds.includes(input.organizationId)) throw forbidden()\n    return\n  }\n\n  const selectedOrganizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  if (!selectedOrganizationId || selectedOrganizationId !== input.organizationId) {\n    throw forbidden()\n  }\n}\n\nasync function buildImportContext(request: Request): Promise<CommandRuntimeContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(request)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request,\n  })\n  return {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request,\n  }\n}\n\nasync function parseValidatePayload(request: Request): Promise<z.infer<typeof inventoryImportValidateSchema>> {\n  const { translate } = await resolveTranslations()\n  const contentType = request.headers.get('content-type') ?? ''\n  if (contentType.includes('multipart/form-data')) {\n    const formData = await request.formData()\n    const organizationId = String(formData.get('organizationId') ?? '').trim()\n    const tenantId = String(formData.get('tenantId') ?? '').trim()\n    const importBatchIdRaw = String(formData.get('importBatchId') ?? '').trim()\n    const skipDuplicatesRaw = String(formData.get('skipDuplicates') ?? '').trim()\n    const modeRaw = String(formData.get('mode') ?? '').trim()\n    const file = formData.get('file')\n    if (!(file instanceof File)) {\n      throw new CrudHttpError(400, {\n        error: translate('wms.backend.inventory.import.errors.csvFileRequired', 'CSV file is required.'),\n      })\n    }\n    const csvText = await file.text()\n    const rows = parseInventoryImportCsv(csvText)\n    return inventoryImportValidateSchema.parse({\n      organizationId,\n      tenantId,\n      ...(importBatchIdRaw ? { importBatchId: importBatchIdRaw } : {}),\n      ...(skipDuplicatesRaw ? { skipDuplicates: skipDuplicatesRaw === 'true' } : {}),\n      ...(modeRaw ? { mode: modeRaw } : {}),\n      rows,\n    })\n  }\n\n  const body = (await readJsonSafe<Record<string, unknown>>(request, {})) ?? {}\n  if (typeof body.csv === 'string' && body.csv.trim().length > 0) {\n    const rows = parseInventoryImportCsv(body.csv)\n    return inventoryImportValidateSchema.parse({\n      ...body,\n      rows,\n    })\n  }\n  return inventoryImportValidateSchema.parse(body)\n}\n\nexport async function executeWmsInventoryImportRoute(options: ImportRouteOptions) {\n  const { translate } = await resolveTranslations()\n  try {\n    const ctx = await buildImportContext(options.request)\n    const auth = ctx.auth\n    if (!auth?.tenantId || !auth.sub) {\n      throw new CrudHttpError(401, { error: translate('wms.errors.unauthorized', 'Unauthorized') })\n    }\n\n    if (options.mode === 'validate') {\n      const parsed = await parseValidatePayload(options.request)\n      assertImportScope(ctx, parsed, translate)\n      const result = await validateInventoryImport(ctx, parsed)\n      return NextResponse.json(result)\n    }\n\n    const parsed = inventoryImportApplySchema.parse(\n      (await readJsonSafe<Record<string, unknown>>(options.request, {})) ?? {},\n    )\n    assertImportScope(ctx, parsed, translate)\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: auth.tenantId,\n      organizationId: ctx.selectedOrganizationId,\n      userId: auth.sub,\n      resourceKind: 'wms.inventory',\n      resourceId: parsed.importBatchId,\n      operation: 'custom',\n      requestMethod: options.request.method,\n      requestHeaders: options.request.headers,\n      mutationPayload: parsed as Record<string, unknown>,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const result = await applyInventoryImport(ctx, {\n      ...parsed,\n      performedBy: auth.sub,\n    })\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: auth.tenantId,\n        organizationId: ctx.selectedOrganizationId,\n        userId: auth.sub,\n        resourceKind: 'wms.inventory',\n        resourceId: parsed.importBatchId,\n        operation: 'custom',\n        requestMethod: options.request.method,\n        requestHeaders: options.request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: options.routePath,\n      method: 'POST',\n      request: {\n        method: 'POST',\n        url: options.request.url,\n        body: parsed as Record<string, unknown>,\n        headers: Object.fromEntries(options.request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: result as Record<string, unknown>,\n        headers: {},\n      },\n      context: {\n        em: ctx.container.resolve('em'),\n        container: ctx.container,\n        userId: auth.sub,\n        organizationId: ctx.selectedOrganizationId,\n        tenantId: auth.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json(\n        {\n          error: translate('wms.backend.inventory.import.errors.validationFailed', 'Validation failed.'),\n          details: error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    logger.error('inventory import route failed', { routePath: options.routePath, mode: options.mode, err: error })\n    return NextResponse.json(\n      { error: translate('wms.errors.internalServerError', 'Internal server error') },\n      { status: 500 },\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,+BAA+B;AACxC,SAAS,sBAAsB,+BAA+B;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,KAAK;AAejC,SAAS,kBACP,KACA,OACA,WACM;AACN,QAAM,YAAY,MAChB,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,CAAC;AAClF,MAAI,IAAI,MAAM,iBAAiB,KAAM;AAErC,QAAM,gBAAgB,IAAI,MAAM,YAAY;AAC5C,MAAI,CAAC,iBAAiB,kBAAkB,MAAM,UAAU;AACtD,UAAM,UAAU;AAAA,EAClB;AAEA,QAAM,aAAa,IAAI,mBAAmB,cAAc;AACxD,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,QAAI,CAAC,WAAW,SAAS,MAAM,cAAc,EAAG,OAAM,UAAU;AAChE;AAAA,EACF;AAEA,QAAM,yBAAyB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AAChF,MAAI,CAAC,0BAA0B,2BAA2B,MAAM,gBAAgB;AAC9E,UAAM,UAAU;AAAA,EAClB;AACF;AAEA,eAAe,mBAAmB,SAAkD;AAClF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,EAC9F;AACA,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,SAA0E;AAC5G,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,YAAY,SAAS,qBAAqB,GAAG;AAC/C,UAAM,WAAW,MAAM,QAAQ,SAAS;AACxC,UAAM,iBAAiB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AACzE,UAAM,WAAW,OAAO,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,KAAK;AAC7D,UAAM,mBAAmB,OAAO,SAAS,IAAI,eAAe,KAAK,EAAE,EAAE,KAAK;AAC1E,UAAM,oBAAoB,OAAO,SAAS,IAAI,gBAAgB,KAAK,EAAE,EAAE,KAAK;AAC5E,UAAM,UAAU,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACxD,UAAM,OAAO,SAAS,IAAI,MAAM;AAChC,QAAI,EAAE,gBAAgB,OAAO;AAC3B,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,uDAAuD,uBAAuB;AAAA,MACjG,CAAC;AAAA,IACH;AACA,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAM,OAAO,wBAAwB,OAAO;AAC5C,WAAO,8BAA8B,MAAM;AAAA,MACzC;AAAA,MACA;AAAA,MACA,GAAI,mBAAmB,EAAE,eAAe,iBAAiB,IAAI,CAAC;AAAA,MAC9D,GAAI,oBAAoB,EAAE,gBAAgB,sBAAsB,OAAO,IAAI,CAAC;AAAA,MAC5E,GAAI,UAAU,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,OAAQ,MAAM,aAAsC,SAAS,CAAC,CAAC,KAAM,CAAC;AAC5E,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,GAAG;AAC9D,UAAM,OAAO,wBAAwB,KAAK,GAAG;AAC7C,WAAO,8BAA8B,MAAM;AAAA,MACzC,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,8BAA8B,MAAM,IAAI;AACjD;AAEA,eAAsB,+BAA+B,SAA6B;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,MAAM,MAAM,mBAAmB,QAAQ,OAAO;AACpD,UAAM,OAAO,IAAI;AACjB,QAAI,CAAC,MAAM,YAAY,CAAC,KAAK,KAAK;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,CAAC;AAAA,IAC9F;AAEA,QAAI,QAAQ,SAAS,YAAY;AAC/B,YAAMA,UAAS,MAAM,qBAAqB,QAAQ,OAAO;AACzD,wBAAkB,KAAKA,SAAQ,SAAS;AACxC,YAAMC,UAAS,MAAM,wBAAwB,KAAKD,OAAM;AACxD,aAAO,aAAa,KAAKC,OAAM;AAAA,IACjC;AAEA,UAAM,SAAS,2BAA2B;AAAA,MACvC,MAAM,aAAsC,QAAQ,SAAS,CAAC,CAAC,KAAM,CAAC;AAAA,IACzE;AACA,sBAAkB,KAAK,QAAQ,SAAS;AACxC,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,KAAK;AAAA,MACf,gBAAgB,IAAI;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,QAAQ,QAAQ;AAAA,MAC/B,gBAAgB,QAAQ,QAAQ;AAAA,MAChC,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,SAAS,MAAM,qBAAqB,KAAK;AAAA,MAC7C,GAAG;AAAA,MACH,aAAa,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,KAAK;AAAA,QACf,gBAAgB,IAAI;AAAA,QACpB,QAAQ,KAAK;AAAA,QACb,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ,QAAQ;AAAA,QACrB,MAAM;AAAA,QACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MAC/D;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC9B,WAAW,IAAI;AAAA,QACf,QAAQ,KAAK;AAAA,QACb,gBAAgB,IAAI;AAAA,QACpB,UAAU,KAAK;AAAA,MACjB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,wDAAwD,oBAAoB;AAAA,UAC7F,SAAS,MAAM;AAAA,QACjB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,MAAM,iCAAiC,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,MAAM,KAAK,MAAM,CAAC;AAC9G,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,uBAAuB,EAAE;AAAA,MAC9E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": ["parsed", "result"]
 }

package/dist/modules/wms/api/sales-orders/[salesOrderId]/warehouse-assignment/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import {
@@ -58,7 +59,7 @@ async function resolveCommandContext(request) {
     container,
     auth,
     organizationScope,
-    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,
+    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,
     organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
     request
   };

package/dist/modules/wms/api/sales-orders/[salesOrderId]/warehouse-assignment/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/wms/api/sales-orders/%5BsalesOrderId%5D/warehouse-assignment/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { salesOrderWarehouseAssignBodySchema } from '../../../../data/validators'\nimport { loadSalesOrderWarehouseAssignmentView } from '../../../../lib/salesOrderWarehouseAssignment'\nimport { executeWmsCustomPostRoute } from '../../../inventory/helpers'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('wms')\n\nconst paramsSchema = z.object({\n  salesOrderId: z.string().uuid(),\n})\n\nconst assignmentResponseSchema = z.object({\n  assignment: z\n    .object({\n      id: z.string().uuid(),\n      salesOrderId: z.string().uuid(),\n      warehouseId: z.string().uuid(),\n      warehouseName: z.string().nullable(),\n      warehouseCode: z.string().nullable(),\n      notes: z.string().nullable(),\n      assignedBy: z.string().uuid().nullable(),\n    })\n    .nullable(),\n})\n\nconst assignSuccessSchema = z.object({\n  ok: z.literal(true),\n  assignmentId: z.string().uuid(),\n  warehouseId: z.string().uuid(),\n})\n\nconst okSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n  PATCH: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n  DELETE: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n}\n\nasync function resolveCommandContext(request: Request): Promise<CommandRuntimeContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(request)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request,\n  })\n  return {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: organizationScope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request,\n  }\n}\n\nfunction resolveScope(ctx: CommandRuntimeContext) {\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const tenantId = ctx.auth?.tenantId ?? null\n  if (!organizationId || !tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  return { organizationId, tenantId }\n}\n\nexport async function GET(\n  request: Request,\n  { params }: { params: { salesOrderId: string } },\n) {\n  try {\n    const parsedParams = paramsSchema.parse(params)\n    const ctx = await resolveCommandContext(request)\n    const scope = resolveScope(ctx)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const assignment = await loadSalesOrderWarehouseAssignmentView(\n      em,\n      parsedParams.salesOrderId,\n      scope,\n    )\n    return NextResponse.json({ assignment })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('GET warehouse-assignment failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nasync function executeAssignMutation(request: Request, salesOrderId: string) {\n  const body = await readJsonSafe<Record<string, unknown>>(request, {})\n  const parsedBody = salesOrderWarehouseAssignBodySchema.parse(body)\n  const scopedRequest = new Request(request.url, {\n    method: 'POST',\n    headers: request.headers,\n    body: JSON.stringify({\n      ...parsedBody,\n      salesOrderId,\n    }),\n  })\n  return executeWmsCustomPostRoute({\n    request: scopedRequest,\n    routePath: `wms/sales-orders/${salesOrderId}/warehouse-assignment`,\n    inputSchema: z.object({\n      salesOrderId: z.string().uuid(),\n      warehouseId: z.string().uuid(),\n      notes: z.string().trim().max(500).optional(),\n      tenantId: z.string().uuid().optional(),\n      organizationId: z.string().uuid().optional(),\n      metadata: z.record(z.string(), z.unknown()).optional(),\n    }),\n    commandId: 'wms.sales-order.assign-warehouse',\n    describeResource: (input) => ({\n      resourceKind: 'wms.sales_order_warehouse_assignment',\n      resourceId: input.salesOrderId,\n    }),\n    mapSuccess: (result: { assignmentId: string; warehouseId: string }) => ({\n      ok: true,\n      assignmentId: result.assignmentId,\n      warehouseId: result.warehouseId,\n    }),\n  })\n}\n\nexport async function PUT(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  return executeAssignMutation(request, parsedParams.salesOrderId)\n}\n\nexport async function PATCH(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  return executeAssignMutation(request, parsedParams.salesOrderId)\n}\n\nexport async function DELETE(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  try {\n    const parsedParams = paramsSchema.parse(routeContext.params)\n    const ctx = await resolveCommandContext(request)\n    const scope = resolveScope(ctx)\n    const resource = {\n      resourceKind: 'wms.sales_order_warehouse_assignment',\n      resourceId: parsedParams.salesOrderId,\n    }\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: request.method,\n      requestHeaders: request.headers,\n      mutationPayload: { salesOrderId: parsedParams.salesOrderId },\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    await commandBus.execute('wms.sales-order.unassign-warehouse', {\n      input: {\n        salesOrderId: parsedParams.salesOrderId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n      },\n      ctx,\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: request.method,\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const responseBody = { ok: true as const }\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: `wms/sales-orders/${parsedParams.salesOrderId}/warehouse-assignment`,\n      method: 'DELETE',\n      request: {\n        method: 'DELETE',\n        url: request.url,\n        body: { salesOrderId: parsedParams.salesOrderId },\n        headers: Object.fromEntries(request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: ctx.container.resolve('em'),\n        container: ctx.container,\n        userId: ctx.auth?.sub ?? '',\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('DELETE warehouse-assignment failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Sales order warehouse assignment',\n  methods: {\n    GET: {\n      summary: 'Get warehouse assignment for sales order',\n      description:\n        'Returns the explicit WMS warehouse assignment for a sales order, or null when none is set.',\n      responses: [\n        { status: 200, description: 'Assignment state', schema: assignmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Assign warehouse to sales order',\n      description:\n        'Creates or replaces the explicit warehouse assignment for a sales order.',\n      requestBody: { contentType: 'application/json', schema: salesOrderWarehouseAssignBodySchema },\n      responses: [\n        { status: 200, description: 'Warehouse assigned', schema: assignSuccessSchema },\n        { status: 201, description: 'Warehouse assigned', schema: assignSuccessSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Warehouse not found', schema: errorSchema },\n        { status: 422, description: 'Warehouse is inactive', schema: errorSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Patch warehouse assignment for sales order',\n      description: 'Same as PUT \u2014 upserts the explicit warehouse assignment.',\n      requestBody: { contentType: 'application/json', schema: salesOrderWarehouseAssignBodySchema },\n      responses: [{ status: 200, description: 'Warehouse assigned', schema: assignSuccessSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Remove warehouse assignment from sales order',\n      description: 'Clears the explicit assignment so enricher and automation fall back again.',\n      responses: [{ status: 200, description: 'Assignment removed', schema: okSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AACpD,SAAS,6CAA6C;AACtD,SAAS,iCAAiC;AAC1C,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,KAAK;AAEjC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,KAAK;AAChC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EACT,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAED,MAAM,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACjD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAAA,EACxD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACzE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,eAAe,sBAAsB,SAAkD;AACrF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,mBAAmB,cAAc,KAAK,SAAS;AAAA,IACvE,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,SAAS,aAAa,KAA4B;AAChD,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,SAAO,EAAE,gBAAgB,SAAS;AACpC;AAEA,eAAsB,IACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,eAAe,aAAa,MAAM,MAAM;AAC9C,UAAM,MAAM,MAAM,sBAAsB,OAAO;AAC/C,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA,aAAa;AAAA,MACb;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,WAAW,CAAC;AAAA,EACzC,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,mCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,eAAe,sBAAsB,SAAkB,cAAsB;AAC3E,QAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,QAAM,aAAa,oCAAoC,MAAM,IAAI;AACjE,QAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,IAC7C,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,MAAM,KAAK,UAAU;AAAA,MACnB,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,0BAA0B;AAAA,IAC/B,SAAS;AAAA,IACT,WAAW,oBAAoB,YAAY;AAAA,IAC3C,aAAa,EAAE,OAAO;AAAA,MACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,MAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC3C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MAC3C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACvD,CAAC;AAAA,IACD,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,IACpB;AAAA,IACA,YAAY,CAAC,YAA2D;AAAA,MACtE,IAAI;AAAA,MACJ,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IACpB,SACA,cACA;AACA,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,SAAO,sBAAsB,SAAS,aAAa,YAAY;AACjE;AAEA,eAAsB,MACpB,SACA,cACA;AACA,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,SAAO,sBAAsB,SAAS,aAAa,YAAY;AACjE;AAEA,eAAsB,OACpB,SACA,cACA;AACA,MAAI;AACF,UAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,UAAM,MAAM,MAAM,sBAAsB,OAAO;AAC/C,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,WAAW;AAAA,MACf,cAAc;AAAA,MACd,YAAY,aAAa;AAAA,IAC3B;AACA,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ;AAAA,MACvB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,EAAE,cAAc,aAAa,aAAa;AAAA,IAC7D,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,WAAW,QAAQ,sCAAsC;AAAA,MAC7D,OAAO;AAAA,QACL,cAAc,aAAa;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,EAAE,IAAI,KAAc;AACzC,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,oBAAoB,aAAa,YAAY;AAAA,MACxD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ;AAAA,QACb,MAAM,EAAE,cAAc,aAAa,aAAa;AAAA,QAChD,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MACvD;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC9B,WAAW,IAAI;AAAA,QACf,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACnF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oCAAoC;AAAA,MAC5F,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oCAAoC;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,SAAS,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { salesOrderWarehouseAssignBodySchema } from '../../../../data/validators'\nimport { loadSalesOrderWarehouseAssignmentView } from '../../../../lib/salesOrderWarehouseAssignment'\nimport { executeWmsCustomPostRoute } from '../../../inventory/helpers'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('wms')\n\nconst paramsSchema = z.object({\n  salesOrderId: z.string().uuid(),\n})\n\nconst assignmentResponseSchema = z.object({\n  assignment: z\n    .object({\n      id: z.string().uuid(),\n      salesOrderId: z.string().uuid(),\n      warehouseId: z.string().uuid(),\n      warehouseName: z.string().nullable(),\n      warehouseCode: z.string().nullable(),\n      notes: z.string().nullable(),\n      assignedBy: z.string().uuid().nullable(),\n    })\n    .nullable(),\n})\n\nconst assignSuccessSchema = z.object({\n  ok: z.literal(true),\n  assignmentId: z.string().uuid(),\n  warehouseId: z.string().uuid(),\n})\n\nconst okSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ error: z.string() })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['wms.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n  PATCH: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n  DELETE: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },\n}\n\nasync function resolveCommandContext(request: Request): Promise<CommandRuntimeContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(request)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request,\n  })\n  return {\n    container,\n    auth,\n    organizationScope,\n    selectedOrganizationId: resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null,\n    organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request,\n  }\n}\n\nfunction resolveScope(ctx: CommandRuntimeContext) {\n  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null\n  const tenantId = ctx.auth?.tenantId ?? null\n  if (!organizationId || !tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  return { organizationId, tenantId }\n}\n\nexport async function GET(\n  request: Request,\n  { params }: { params: { salesOrderId: string } },\n) {\n  try {\n    const parsedParams = paramsSchema.parse(params)\n    const ctx = await resolveCommandContext(request)\n    const scope = resolveScope(ctx)\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const assignment = await loadSalesOrderWarehouseAssignmentView(\n      em,\n      parsedParams.salesOrderId,\n      scope,\n    )\n    return NextResponse.json({ assignment })\n  } catch (error) {\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('GET warehouse-assignment failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nasync function executeAssignMutation(request: Request, salesOrderId: string) {\n  const body = await readJsonSafe<Record<string, unknown>>(request, {})\n  const parsedBody = salesOrderWarehouseAssignBodySchema.parse(body)\n  const scopedRequest = new Request(request.url, {\n    method: 'POST',\n    headers: request.headers,\n    body: JSON.stringify({\n      ...parsedBody,\n      salesOrderId,\n    }),\n  })\n  return executeWmsCustomPostRoute({\n    request: scopedRequest,\n    routePath: `wms/sales-orders/${salesOrderId}/warehouse-assignment`,\n    inputSchema: z.object({\n      salesOrderId: z.string().uuid(),\n      warehouseId: z.string().uuid(),\n      notes: z.string().trim().max(500).optional(),\n      tenantId: z.string().uuid().optional(),\n      organizationId: z.string().uuid().optional(),\n      metadata: z.record(z.string(), z.unknown()).optional(),\n    }),\n    commandId: 'wms.sales-order.assign-warehouse',\n    describeResource: (input) => ({\n      resourceKind: 'wms.sales_order_warehouse_assignment',\n      resourceId: input.salesOrderId,\n    }),\n    mapSuccess: (result: { assignmentId: string; warehouseId: string }) => ({\n      ok: true,\n      assignmentId: result.assignmentId,\n      warehouseId: result.warehouseId,\n    }),\n  })\n}\n\nexport async function PUT(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  return executeAssignMutation(request, parsedParams.salesOrderId)\n}\n\nexport async function PATCH(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  const parsedParams = paramsSchema.parse(routeContext.params)\n  return executeAssignMutation(request, parsedParams.salesOrderId)\n}\n\nexport async function DELETE(\n  request: Request,\n  routeContext: { params: { salesOrderId: string } },\n) {\n  try {\n    const parsedParams = paramsSchema.parse(routeContext.params)\n    const ctx = await resolveCommandContext(request)\n    const scope = resolveScope(ctx)\n    const resource = {\n      resourceKind: 'wms.sales_order_warehouse_assignment',\n      resourceId: parsedParams.salesOrderId,\n    }\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: ctx.auth?.sub ?? '',\n      resourceKind: resource.resourceKind,\n      resourceId: resource.resourceId,\n      operation: 'custom',\n      requestMethod: request.method,\n      requestHeaders: request.headers,\n      mutationPayload: { salesOrderId: parsedParams.salesOrderId },\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    await commandBus.execute('wms.sales-order.unassign-warehouse', {\n      input: {\n        salesOrderId: parsedParams.salesOrderId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n      },\n      ctx,\n    })\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: ctx.auth?.sub ?? '',\n        resourceKind: resource.resourceKind,\n        resourceId: resource.resourceId,\n        operation: 'custom',\n        requestMethod: request.method,\n        requestHeaders: request.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const responseBody = { ok: true as const }\n    const intercepted = await runCustomRouteAfterInterceptors({\n      routePath: `wms/sales-orders/${parsedParams.salesOrderId}/warehouse-assignment`,\n      method: 'DELETE',\n      request: {\n        method: 'DELETE',\n        url: request.url,\n        body: { salesOrderId: parsedParams.salesOrderId },\n        headers: Object.fromEntries(request.headers.entries()),\n      },\n      response: {\n        statusCode: 200,\n        body: responseBody,\n        headers: {},\n      },\n      context: {\n        em: ctx.container.resolve('em'),\n        container: ctx.container,\n        userId: ctx.auth?.sub ?? '',\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n    })\n    if (!intercepted.ok) {\n      return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n    }\n    return NextResponse.json(intercepted.body, { status: intercepted.statusCode })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (error instanceof CrudHttpError) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })\n    }\n    logger.error('DELETE warehouse-assignment failed', { err: error })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'WMS',\n  summary: 'Sales order warehouse assignment',\n  methods: {\n    GET: {\n      summary: 'Get warehouse assignment for sales order',\n      description:\n        'Returns the explicit WMS warehouse assignment for a sales order, or null when none is set.',\n      responses: [\n        { status: 200, description: 'Assignment state', schema: assignmentResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Assign warehouse to sales order',\n      description:\n        'Creates or replaces the explicit warehouse assignment for a sales order.',\n      requestBody: { contentType: 'application/json', schema: salesOrderWarehouseAssignBodySchema },\n      responses: [\n        { status: 200, description: 'Warehouse assigned', schema: assignSuccessSchema },\n        { status: 201, description: 'Warehouse assigned', schema: assignSuccessSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Warehouse not found', schema: errorSchema },\n        { status: 422, description: 'Warehouse is inactive', schema: errorSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Patch warehouse assignment for sales order',\n      description: 'Same as PUT \u2014 upserts the explicit warehouse assignment.',\n      requestBody: { contentType: 'application/json', schema: salesOrderWarehouseAssignBodySchema },\n      responses: [{ status: 200, description: 'Warehouse assigned', schema: assignSuccessSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Remove warehouse assignment from sales order',\n      description: 'Clears the explicit assignment so enricher and automation fall back again.',\n      responses: [{ status: 200, description: 'Assignment removed', schema: okSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,qBAAqB;AAC9B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AACpD,SAAS,6CAA6C;AACtD,SAAS,iCAAiC;AAC1C,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,KAAK;AAEjC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,KAAK;AAChC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EACT,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,IACnC,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,SAAS;AACd,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAC/B,CAAC;AAED,MAAM,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACjD,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,UAAU,EAAE;AAAA,EACxD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACvE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAAA,EACzE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC5E;AAEA,eAAe,sBAAsB,SAAkD;AACrF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,QAAM,oBAAoB,MAAM,mCAAmC;AAAA,IACjE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,wBAAwB,kCAAkC,mBAAmB,IAAI,KAAK;AAAA,IACtF,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,SAAS,aAAa,KAA4B;AAChD,QAAM,iBAAiB,IAAI,0BAA0B,IAAI,MAAM,SAAS;AACxE,QAAM,WAAW,IAAI,MAAM,YAAY;AACvC,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,SAAO,EAAE,gBAAgB,SAAS;AACpC;AAEA,eAAsB,IACpB,SACA,EAAE,OAAO,GACT;AACA,MAAI;AACF,UAAM,eAAe,aAAa,MAAM,MAAM;AAC9C,UAAM,MAAM,MAAM,sBAAsB,OAAO;AAC/C,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA,aAAa;AAAA,MACb;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,WAAW,CAAC;AAAA,EACzC,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,mCAAmC,EAAE,KAAK,MAAM,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,eAAe,sBAAsB,SAAkB,cAAsB;AAC3E,QAAM,OAAO,MAAM,aAAsC,SAAS,CAAC,CAAC;AACpE,QAAM,aAAa,oCAAoC,MAAM,IAAI;AACjE,QAAM,gBAAgB,IAAI,QAAQ,QAAQ,KAAK;AAAA,IAC7C,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB,MAAM,KAAK,UAAU;AAAA,MACnB,GAAG;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,0BAA0B;AAAA,IAC/B,SAAS;AAAA,IACT,WAAW,oBAAoB,YAAY;AAAA,IAC3C,aAAa,EAAE,OAAO;AAAA,MACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,MAC9B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,MAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,MAC3C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MAC3C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACvD,CAAC;AAAA,IACD,WAAW;AAAA,IACX,kBAAkB,CAAC,WAAW;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,IACpB;AAAA,IACA,YAAY,CAAC,YAA2D;AAAA,MACtE,IAAI;AAAA,MACJ,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IACpB,SACA,cACA;AACA,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,SAAO,sBAAsB,SAAS,aAAa,YAAY;AACjE;AAEA,eAAsB,MACpB,SACA,cACA;AACA,QAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,SAAO,sBAAsB,SAAS,aAAa,YAAY;AACjE;AAEA,eAAsB,OACpB,SACA,cACA;AACA,MAAI;AACF,UAAM,eAAe,aAAa,MAAM,aAAa,MAAM;AAC3D,UAAM,MAAM,MAAM,sBAAsB,OAAO;AAC/C,UAAM,QAAQ,aAAa,GAAG;AAC9B,UAAM,WAAW;AAAA,MACf,cAAc;AAAA,MACd,YAAY,aAAa;AAAA,IAC3B;AACA,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,IAAI,MAAM,OAAO;AAAA,MACzB,cAAc,SAAS;AAAA,MACvB,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,QAAQ;AAAA,MACvB,gBAAgB,QAAQ;AAAA,MACxB,iBAAiB,EAAE,cAAc,aAAa,aAAa;AAAA,IAC7D,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,WAAW,QAAQ,sCAAsC;AAAA,MAC7D,OAAO;AAAA,QACL,cAAc,aAAa;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,cAAc,SAAS;AAAA,QACvB,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,QAAQ;AAAA,QACvB,gBAAgB,QAAQ;AAAA,QACxB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,eAAe,EAAE,IAAI,KAAc;AACzC,UAAM,cAAc,MAAM,gCAAgC;AAAA,MACxD,WAAW,oBAAoB,aAAa,YAAY;AAAA,MACxD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,QAAQ;AAAA,QACR,KAAK,QAAQ;AAAA,QACb,MAAM,EAAE,cAAc,aAAa,aAAa;AAAA,QAChD,SAAS,OAAO,YAAY,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MACvD;AAAA,MACA,UAAU;AAAA,QACR,YAAY;AAAA,QACZ,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,MACA,SAAS;AAAA,QACP,IAAI,IAAI,UAAU,QAAQ,IAAI;AAAA,QAC9B,WAAW,IAAI;AAAA,QACf,QAAQ,IAAI,MAAM,OAAO;AAAA,QACzB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,IAC/E;AACA,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,WAAW,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,iBAAiB,eAAe;AAClC,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjG;AACA,WAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACnF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oCAAoC;AAAA,MAC5F,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oCAAoC;AAAA,MAC5F,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,oBAAoB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,SAAS,CAAC;AAAA,MAChF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }