@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/customers/api/deals/[id]/people/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/deals/%5Bid%5D/people/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst querySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(20),\n  search: z.string().optional(),\n  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),\n})\n\ntype DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'\n\nfunction normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {\n  if (sort === 'name-asc') return 'label-asc'\n  if (sort === 'name-desc') return 'label-desc'\n  return sort\n}\n\ntype DealPersonItem = {\n  id: string\n  label: string\n  subtitle: string | null\n  kind: 'person'\n  linkedAt: string\n  isPrimary: boolean\n}\n\nfunction matchesSearch(item: DealPersonItem, query: string): boolean {\n  const normalized = query.trim().toLowerCase()\n  if (!normalized.length) return true\n  return [item.label, item.subtitle]\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n    .some((value) => value.toLowerCase().includes(normalized))\n}\n\nfunction sortItems(items: DealPersonItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealPersonItem[] {\n  if (sort === 'recent') {\n    return [...items].sort((left, right) => {\n      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()\n      if (compare !== 0) return compare\n      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    })\n  }\n  return [...items].sort((left, right) => {\n    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    return sort === 'label-asc' ? compare : -compare\n  })\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { id?: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })\n\n    const url = new URL(req.url)\n    const query = querySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sort: url.searchParams.get('sort') ?? undefined,\n    })\n\n    const container = await createRequestContainer()\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const em = (container.resolve('em') as EntityManager).fork()\n    const decryptionScope = {\n      tenantId: auth.tenantId,\n      organizationId: scope?.selectedId ?? auth.orgId ?? null,\n    }\n\n    const deal = await findOneWithDecryption(\n      em,\n      CustomerDeal,\n      { id, tenantId: auth.tenantId, deletedAt: null },\n      {},\n      decryptionScope,\n    )\n    if (!deal) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n    // the parent-not-found above \u2014 so it cannot reveal that a deal exists in an\n    // organization the caller cannot see.\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }\n    const links = await findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { deal: deal.id },\n      { populate: ['person'] },\n      entityScope,\n    )\n\n    const items = links\n      .map((link) => {\n        const person = link.person as CustomerEntity | null\n        if (!person?.id) return null\n        return {\n          id: person.id,\n          label: person.displayName ?? person.primaryEmail ?? person.id,\n          subtitle: person.primaryEmail ?? person.primaryPhone ?? null,\n          kind: 'person',\n          linkedAt: link.createdAt.toISOString(),\n          isPrimary: link.isPrimary === true,\n        } satisfies DealPersonItem\n      })\n      .filter((item): item is DealPersonItem => item !== null)\n\n    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items\n    const sorted = sortItems(filtered, normalizeSort(query.sort))\n    const total = sorted.length\n    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))\n    const page = Math.min(query.page, totalPages)\n    const start = (page - 1) * query.pageSize\n\n    return NextResponse.json({\n      items: sorted.slice(start, start + query.pageSize),\n      total,\n      page,\n      pageSize: query.pageSize,\n      totalPages,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    logger.error('customers.deals.people.GET', { err: error })\n    return NextResponse.json({ error: translate('customers.errors.deal_people_load_failed', 'Failed to load linked people') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'List linked people for a deal',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated linked people',\n          schema: z.object({\n            items: z.array(\n              z.object({\n                id: z.string().uuid(),\n                label: z.string(),\n                subtitle: z.string().nullable(),\n                kind: z.literal('person'),\n                linkedAt: z.string(),\n                isPrimary: z.boolean(),\n              }),\n            ),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD,SAAS,cAAc,8BAA8C;AACrE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,KAAK,CAAC,aAAa,cAAc,YAAY,aAAa,QAAQ,CAAC,EAAE,QAAQ,WAAW;AAClG,CAAC;AAID,SAAS,cAAc,MAAiE;AACtF,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAWA,SAAS,cAAc,MAAsB,OAAwB;AACnE,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO,CAAC,KAAK,OAAO,KAAK,QAAQ,EAC9B,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,CAAC,UAAU,MAAM,YAAY,EAAE,SAAS,UAAU,CAAC;AAC7D;AAEA,SAAS,UAAU,OAAyB,MAA+D;AACzG,MAAI,SAAS,UAAU;AACrB,WAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,YAAM,UAAU,IAAI,KAAK,MAAM,QAAQ,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACrF,UAAI,YAAY,EAAG,QAAO;AAC1B,aAAO,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AAAA,IACjF,CAAC;AAAA,EACH;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,UAAM,UAAU,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AACxF,WAAO,SAAS,cAAc,UAAU,CAAC;AAAA,EAC3C,CAAC;AACH;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAAmC;AACzE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAE3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACxC,CAAC;AAED,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,cAAc,KAAK,SAAS;AAAA,IACrD;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAKA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,KAAK,eAAe,CAAC,GAAG;AAC1F,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AACnF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK,GAAG;AAAA,MAChB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAEA,UAAM,QAAQ,MACX,IAAI,CAAC,SAAS;AACb,YAAM,SAAS,KAAK;AACpB,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,OAAO,OAAO,eAAe,OAAO,gBAAgB,OAAO;AAAA,QAC3D,UAAU,OAAO,gBAAgB,OAAO,gBAAgB;AAAA,QACxD,MAAM;AAAA,QACN,UAAU,KAAK,UAAU,YAAY;AAAA,QACrC,WAAW,KAAK,cAAc;AAAA,MAChC;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAiC,SAAS,IAAI;AAEzD,UAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,SAAS,MAAM,OAAO,CAAC,SAAS,cAAc,MAAM,MAAM,UAAU,EAAE,CAAC,IAAI;AACjH,UAAM,SAAS,UAAU,UAAU,cAAc,MAAM,IAAI,CAAC;AAC5D,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAChE,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,KAAK,MAAM;AAEjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MACjD;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4CAA4C,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE;AAAA,cACP,EAAE,OAAO;AAAA,gBACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,gBACpB,OAAO,EAAE,OAAO;AAAA,gBAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC9B,MAAM,EAAE,QAAQ,QAAQ;AAAA,gBACxB,UAAU,EAAE,OAAO;AAAA,gBACnB,WAAW,EAAE,QAAQ;AAAA,cACvB,CAAC;AAAA,YACH;AAAA,YACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst querySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(20),\n  search: z.string().optional(),\n  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),\n})\n\ntype DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'\n\nfunction normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {\n  if (sort === 'name-asc') return 'label-asc'\n  if (sort === 'name-desc') return 'label-desc'\n  return sort\n}\n\ntype DealPersonItem = {\n  id: string\n  label: string\n  subtitle: string | null\n  kind: 'person'\n  linkedAt: string\n  isPrimary: boolean\n}\n\nfunction matchesSearch(item: DealPersonItem, query: string): boolean {\n  const normalized = query.trim().toLowerCase()\n  if (!normalized.length) return true\n  return [item.label, item.subtitle]\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n    .some((value) => value.toLowerCase().includes(normalized))\n}\n\nfunction sortItems(items: DealPersonItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealPersonItem[] {\n  if (sort === 'recent') {\n    return [...items].sort((left, right) => {\n      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()\n      if (compare !== 0) return compare\n      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    })\n  }\n  return [...items].sort((left, right) => {\n    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    return sort === 'label-asc' ? compare : -compare\n  })\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { id?: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })\n\n    const url = new URL(req.url)\n    const query = querySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sort: url.searchParams.get('sort') ?? undefined,\n    })\n\n    const container = await createRequestContainer()\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const em = (container.resolve('em') as EntityManager).fork()\n    const decryptionScope = {\n      tenantId: auth.tenantId,\n      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    }\n\n    const deal = await findOneWithDecryption(\n      em,\n      CustomerDeal,\n      { id, tenantId: auth.tenantId, deletedAt: null },\n      {},\n      decryptionScope,\n    )\n    if (!deal) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n    // the parent-not-found above \u2014 so it cannot reveal that a deal exists in an\n    // organization the caller cannot see.\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }\n    const links = await findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { deal: deal.id },\n      { populate: ['person'] },\n      entityScope,\n    )\n\n    const items = links\n      .map((link) => {\n        const person = link.person as CustomerEntity | null\n        if (!person?.id) return null\n        return {\n          id: person.id,\n          label: person.displayName ?? person.primaryEmail ?? person.id,\n          subtitle: person.primaryEmail ?? person.primaryPhone ?? null,\n          kind: 'person',\n          linkedAt: link.createdAt.toISOString(),\n          isPrimary: link.isPrimary === true,\n        } satisfies DealPersonItem\n      })\n      .filter((item): item is DealPersonItem => item !== null)\n\n    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items\n    const sorted = sortItems(filtered, normalizeSort(query.sort))\n    const total = sorted.length\n    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))\n    const page = Math.min(query.page, totalPages)\n    const start = (page - 1) * query.pageSize\n\n    return NextResponse.json({\n      items: sorted.slice(start, start + query.pageSize),\n      total,\n      page,\n      pageSize: query.pageSize,\n      totalPages,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    logger.error('customers.deals.people.GET', { err: error })\n    return NextResponse.json({ error: translate('customers.errors.deal_people_load_failed', 'Failed to load linked people') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'List linked people for a deal',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated linked people',\n          schema: z.object({\n            items: z.array(\n              z.object({\n                id: z.string().uuid(),\n                label: z.string(),\n                subtitle: z.string().nullable(),\n                kind: z.literal('person'),\n                linkedAt: z.string(),\n                isPrimary: z.boolean(),\n              }),\n            ),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD,SAAS,cAAc,8BAA8C;AACrE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,KAAK,CAAC,aAAa,cAAc,YAAY,aAAa,QAAQ,CAAC,EAAE,QAAQ,WAAW;AAClG,CAAC;AAID,SAAS,cAAc,MAAiE;AACtF,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAWA,SAAS,cAAc,MAAsB,OAAwB;AACnE,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO,CAAC,KAAK,OAAO,KAAK,QAAQ,EAC9B,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,CAAC,UAAU,MAAM,YAAY,EAAE,SAAS,UAAU,CAAC;AAC7D;AAEA,SAAS,UAAU,OAAyB,MAA+D;AACzG,MAAI,SAAS,UAAU;AACrB,WAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,YAAM,UAAU,IAAI,KAAK,MAAM,QAAQ,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACrF,UAAI,YAAY,EAAG,QAAO;AAC1B,aAAO,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AAAA,IACjF,CAAC;AAAA,EACH;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,UAAM,UAAU,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AACxF,WAAO,SAAS,cAAc,UAAU,CAAC;AAAA,EAC3C,CAAC;AACH;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAAmC;AACzE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAE3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACxC,CAAC;AAED,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,gBAAgB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IACpE;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAKA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,KAAK,eAAe,CAAC,GAAG;AAC1F,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AACnF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK,GAAG;AAAA,MAChB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAEA,UAAM,QAAQ,MACX,IAAI,CAAC,SAAS;AACb,YAAM,SAAS,KAAK;AACpB,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,OAAO,OAAO,eAAe,OAAO,gBAAgB,OAAO;AAAA,QAC3D,UAAU,OAAO,gBAAgB,OAAO,gBAAgB;AAAA,QACxD,MAAM;AAAA,QACN,UAAU,KAAK,UAAU,YAAY;AAAA,QACrC,WAAW,KAAK,cAAc;AAAA,MAChC;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAiC,SAAS,IAAI;AAEzD,UAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,SAAS,MAAM,OAAO,CAAC,SAAS,cAAc,MAAM,MAAM,UAAU,EAAE,CAAC,IAAI;AACjH,UAAM,SAAS,UAAU,UAAU,cAAc,MAAM,IAAI,CAAC;AAC5D,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAChE,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,KAAK,MAAM;AAEjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MACjD;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4CAA4C,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE;AAAA,cACP,EAAE,OAAO;AAAA,gBACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,gBACpB,OAAO,EAAE,OAAO;AAAA,gBAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC9B,MAAM,EAAE,QAAQ,QAAQ;AAAA,gBACxB,UAAU,EAAE,OAAO;AAAA,gBACnB,WAAW,EAAE,QAAQ;AAAA,cACvB,CAAC;AAAA,YACH;AAAA,YACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/deals/map/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { readQueryParamList } from "@open-mercato/shared/lib/crud/query-params";
 import { SortDir } from "@open-mercato/shared/lib/query/types";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
@@ -187,10 +188,14 @@ async function GET(req) {
   const queryEngine = container.resolve("queryEngine");
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const effectiveTenantId = scope.tenantId ?? auth.tenantId;
-  const orgScopeIds = scope.filterIds === null ? null : Array.isArray(scope.filterIds) && scope.filterIds.length > 0 ? Array.from(new Set(scope.filterIds.filter((id) => typeof id === "string" && id.length > 0))) : auth.orgId ? [auth.orgId] : [];
-  if (!effectiveTenantId || Array.isArray(orgScopeIds) && orgScopeIds.length === 0) {
+  const { organizationIds } = resolveOrganizationScopeFilter(scope, auth);
+  const orgScopeIds = organizationIds === void 0 ? null : Array.from(new Set(organizationIds.filter((id) => typeof id === "string" && id.length > 0)));
+  if (!effectiveTenantId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
+  if (orgScopeIds?.length === 0) {
+    return emptyMapResponse(query.page, query.pageSize);
+  }
   const orgScopeFilter = orgScopeIds ? { organizationId: { $in: orgScopeIds } } : {};
   const fallbackOrgId = orgScopeIds && orgScopeIds.length > 0 ? orgScopeIds[0] : void 0;
   const decryptionScope = { tenantId: effectiveTenantId, organizationId: fallbackOrgId };

package/dist/modules/customers/api/deals/map/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customers/api/deals/map/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { readQueryParamList } from '@open-mercato/shared/lib/crud/query-params'\nimport { SortDir, type QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerAddress,\n  CustomerDealCompanyLink,\n  CustomerDealPersonLink,\n} from '../../../data/entities'\nimport { buildDealListFilters, dealListQuerySchema } from '../route'\nimport { applyEntityIdRestriction, findMatchingEntityIdsBySearchTokensAcrossSources } from '../../utils'\nimport { createPagedListResponseSchema } from '../../openapi'\nimport {\n  resolveDealLocations,\n  type DealMapAddress,\n  type DealMapLink,\n  type DealMapLocation,\n} from '../../../lib/dealsMapLocation'\nimport { E } from '#generated/entities.ids.generated'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view', 'customers.activities.view'] },\n}\n\nconst mapSortFields = ['createdAt', 'updatedAt', 'title', 'value', 'probability', 'expectedCloseAt'] as const\n\nconst sortFieldMap: Record<(typeof mapSortFields)[number], string> = {\n  createdAt: 'created_at',\n  updatedAt: 'updated_at',\n  title: 'title',\n  value: 'value_amount',\n  probability: 'probability',\n  expectedCloseAt: 'expected_close_at',\n}\n\nconst querySchema = dealListQuerySchema.extend({\n  pageSize: z.coerce.number().min(1).max(100).default(100),\n  sortField: z.enum(mapSortFields).optional(),\n})\n\nconst dealMapAssociationSchema = z.object({\n  id: z.string().uuid(),\n  label: z.string().nullable(),\n})\n\nconst dealMapLocationSchema = z.object({\n  latitude: z.number(),\n  longitude: z.number(),\n  city: z.string().nullable(),\n  region: z.string().nullable(),\n  country: z.string().nullable(),\n  source: z.enum(['company', 'person']),\n  entityId: z.string().uuid(),\n  addressId: z.string().uuid(),\n})\n\nconst dealMapItemSchema = z.object({\n  id: z.string().uuid(),\n  title: z.string().nullable(),\n  status: z.string().nullable(),\n  pipelineId: z.string().uuid().nullable(),\n  pipelineStageId: z.string().uuid().nullable(),\n  pipelineStage: z.string().nullable(),\n  valueAmount: z.number().nullable(),\n  valueCurrency: z.string().nullable(),\n  probability: z.number().nullable(),\n  expectedCloseAt: z.string().nullable(),\n  ownerUserId: z.string().uuid().nullable(),\n  updatedAt: z.string().nullable(),\n  companies: z.array(dealMapAssociationSchema),\n  people: z.array(dealMapAssociationSchema),\n  location: dealMapLocationSchema.nullable(),\n})\n\nconst mapErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Deals map listing with resolved locations',\n  methods: {\n    GET: {\n      summary: 'Paginated deals that have a resolvable map location',\n      description:\n        'Returns a page of deals that have a coordinate-bearing linked company/person address, each enriched with one resolved location (company primary first, then earliest created; person addresses as fallback). Deals with no coordinate-bearing address are excluded entirely, so every item carries a non-null location in normal operation; the schema keeps location nullable only for the rare case where the address is deleted between the located-deal resolution and the page fetch.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'Paged located deals', schema: createPagedListResponseSchema(dealMapItemSchema) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: mapErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: mapErrorSchema },\n        { status: 403, description: 'Missing required features', schema: mapErrorSchema },\n      ],\n    },\n  },\n}\n\ntype DealMapAssociation = z.infer<typeof dealMapAssociationSchema>\n\ntype LinkRow = {\n  dealId: string\n  entityId: string\n  label: string\n  createdAt: Date | string | null\n}\n\nfunction readEntityRef(ref: unknown): { id: string | null; record: Record<string, unknown> | null } {\n  if (typeof ref === 'string') return { id: ref, record: null }\n  if (ref && typeof ref === 'object') {\n    const record = ref as Record<string, unknown>\n    return { id: typeof record.id === 'string' ? record.id : null, record }\n  }\n  return { id: null, record: null }\n}\n\nfunction readLinkRow(link: { deal: unknown; createdAt?: Date | string | null }, linkedRef: unknown): LinkRow | null {\n  const { id: dealId } = readEntityRef(link.deal)\n  if (!dealId) return null\n  const { id: entityId, record } = readEntityRef(linkedRef)\n  if (!entityId) return null\n  const label = record && typeof record.displayName === 'string' ? record.displayName : ''\n  return { dealId, entityId, label, createdAt: link.createdAt ?? null }\n}\n\nfunction groupAssociations(rows: LinkRow[]): Map<string, DealMapAssociation[]> {\n  const byDeal = new Map<string, DealMapAssociation[]>()\n  for (const row of rows) {\n    const bucket = byDeal.get(row.dealId) ?? []\n    if (!bucket.some((entry) => entry.id === row.entityId)) {\n      bucket.push({ id: row.entityId, label: row.label })\n      byDeal.set(row.dealId, bucket)\n    }\n  }\n  return byDeal\n}\n\nfunction toStringOrNull(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction toFiniteNumberOrNull(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isFinite(value) ? value : null\n  if (typeof value === 'string' && value.trim().length > 0) {\n    const parsed = Number(value)\n    return Number.isFinite(parsed) ? parsed : null\n  }\n  return null\n}\n\nfunction toIsoStringOrNull(value: unknown): string | null {\n  if (value instanceof Date) return value.toISOString()\n  return toStringOrNull(value)\n}\n\nfunction readArrayParam(searchParams: URLSearchParams, key: string): string[] | null {\n  const values = readQueryParamList(searchParams, key)\n  return values.length ? values : null\n}\n\nfunction collectRefIds(rows: unknown[], key: string): string[] {\n  const ids = new Set<string>()\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') continue\n    const { id } = readEntityRef((row as Record<string, unknown>)[key])\n    if (id) ids.add(id)\n  }\n  return Array.from(ids)\n}\n\n// The deal-list filter builder may already restrict `id` (search, association, stuck, or advanced\n// filters). `applyEntityIdRestriction` overwrites an existing `$in`, so intersect the located-deal\n// set with whatever allow-list is already present before re-applying it.\nfunction readFilterIdAllowlist(filters: Record<string, unknown>): string[] | null {\n  const idFilter = filters.id\n  if (!idFilter || typeof idFilter !== 'object' || Array.isArray(idFilter)) return null\n  const record = idFilter as { $eq?: unknown; $in?: unknown }\n  if (typeof record.$eq === 'string') return [record.$eq]\n  if (Array.isArray(record.$in)) return record.$in.filter((value): value is string => typeof value === 'string')\n  return null\n}\n\nfunction emptyMapResponse(page: number, pageSize: number) {\n  return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const params = url.searchParams\n  const parsed = querySchema.safeParse({\n    page: params.get('page') ?? undefined,\n    pageSize: params.get('pageSize') ?? undefined,\n    search: params.get('search') ?? undefined,\n    status: readArrayParam(params, 'status') ?? undefined,\n    pipelineId: readArrayParam(params, 'pipelineId') ?? undefined,\n    pipelineStageId: params.get('pipelineStageId') ?? undefined,\n    ownerUserId: readArrayParam(params, 'ownerUserId') ?? undefined,\n    personId: readArrayParam(params, 'personId') ?? undefined,\n    companyId: readArrayParam(params, 'companyId') ?? undefined,\n    valueCurrency: readArrayParam(params, 'valueCurrency') ?? undefined,\n    expectedCloseAtFrom: params.get('expectedCloseAtFrom') ?? undefined,\n    expectedCloseAtTo: params.get('expectedCloseAtTo') ?? undefined,\n    isStuck: params.get('isStuck') ?? undefined,\n    isOverdue: params.get('isOverdue') ?? undefined,\n    sortField: params.get('sortField') ?? undefined,\n    sortDir: params.get('sortDir') ?? undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n  const query = parsed.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve<EntityManager>('em')\n  const queryEngine = container.resolve<QueryEngine>('queryEngine')\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const effectiveTenantId = scope.tenantId ?? auth.tenantId\n  // `null` = unrestricted access (superadmin or an \"all organizations\" grant): aggregate tenant-wide,\n  // exactly like the deals List route (`makeCrudRoute`) and the query_index status route. A populated\n  // array bounds the query to the caller's visible orgs; an empty array means no org visibility \u2192 401.\n  // The previous guard hard-required `auth.orgId`, which is empty under the header \"All organizations\"\n  // scope, so the map 401'd (and hung on the loading spinner) while List/Kanban aggregated fine (#3481).\n  const orgScopeIds: string[] | null =\n    scope.filterIds === null\n      ? null\n      : Array.isArray(scope.filterIds) && scope.filterIds.length > 0\n        ? Array.from(new Set(scope.filterIds.filter((id) => typeof id === 'string' && id.length > 0)))\n        : auth.orgId\n          ? [auth.orgId]\n          : []\n  if (!effectiveTenantId || (Array.isArray(orgScopeIds) && orgScopeIds.length === 0)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  // Bounded `$in` when the caller is org-restricted; omitted entirely under unrestricted access so\n  // every query stays tenant-scoped only. `fallbackOrgId` is undefined when unrestricted.\n  const orgScopeFilter = orgScopeIds ? { organizationId: { $in: orgScopeIds } } : {}\n  const fallbackOrgId = orgScopeIds && orgScopeIds.length > 0 ? orgScopeIds[0] : undefined\n\n  // `findWithDecryption` decrypts each row with the row's OWN tenant/organization (the encryption\n  // subscriber's resolveScope(target) wins); this scope is only a fallback for rows that carry no\n  // scope columns. CustomerAddress always carries organization_id, so every org's rows still decrypt\n  // correctly under a multi-org / unrestricted scope even though `fallbackOrgId` may be undefined.\n  const decryptionScope = { tenantId: effectiveTenantId, organizationId: fallbackOrgId }\n\n  // Located-only, resolved in two stages so the per-request cost stays page-bounded:\n  // 1) LIGHT id-only queries (FK columns only, no decryption) determine which deals have a\n  //    coordinate-bearing linked company/person, so pagination + `total` operate on located deals.\n  // 2) The HEAVY decrypted/populated fetch (labels + address coordinates) runs only for the deals\n  //    that actually land on the requested page \u2014 never the whole located universe.\n  const coordinateEntityRows = await findWithDecryption(\n    em,\n    CustomerAddress,\n    {\n      latitude: { $ne: null },\n      longitude: { $ne: null },\n      tenantId: effectiveTenantId,\n      ...orgScopeFilter,\n    },\n    { fields: ['entity'] },\n    decryptionScope,\n  )\n  const locatedEntityIds = collectRefIds(coordinateEntityRows, 'entity')\n  if (locatedEntityIds.length === 0) {\n    return emptyMapResponse(query.page, query.pageSize)\n  }\n\n  const [locatedCompanyLinkRows, locatedPersonLinkRows] = await Promise.all([\n    findWithDecryption(\n      em,\n      CustomerDealCompanyLink,\n      { company: { $in: locatedEntityIds } },\n      { fields: ['deal'] },\n      decryptionScope,\n    ),\n    findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { person: { $in: locatedEntityIds } },\n      { fields: ['deal'] },\n      decryptionScope,\n    ),\n  ])\n  const locatedDealIds = Array.from(\n    new Set([\n      ...collectRefIds(locatedCompanyLinkRows, 'deal'),\n      ...collectRefIds(locatedPersonLinkRows, 'deal'),\n    ]),\n  )\n  if (locatedDealIds.length === 0) {\n    return emptyMapResponse(query.page, query.pageSize)\n  }\n\n  const ctx: CrudCtx = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: fallbackOrgId ?? null,\n    organizationIds: orgScopeIds,\n    request: req,\n  }\n\n  const filters = await buildDealListFilters(query, ctx)\n  const existingAllowlist = readFilterIdAllowlist(filters)\n\n  // The map card headline is the linked company/person name, which the deal-field token search\n  // (title/description/status/\u2026) used by `buildDealListFilters` does NOT cover \u2014 so searching a\n  // company/person name a user can plainly see on a card would otherwise return nothing. When a\n  // search term is present, also resolve located deals whose linked company/person ENTITY name\n  // matches, and union them with the deal-field matches. The sentinel \"no match\" id from the\n  // deal-field search drops out naturally at the located intersection below, so no special-casing.\n  let searchAllowlist = existingAllowlist\n  if (query.search && locatedEntityIds.length > 0) {\n    const nameMatchedEntityIds = await findMatchingEntityIdsBySearchTokensAcrossSources({\n      ctx,\n      query: query.search,\n      sources: [\n        {\n          entityType: E.customers.customer_entity,\n          fields: ['display_name', 'primary_email', 'primary_phone', 'description'],\n        },\n      ],\n    })\n    const locatedEntitySet = new Set(locatedEntityIds)\n    const locatedMatchedEntityIds = (nameMatchedEntityIds ?? []).filter((id) => locatedEntitySet.has(id))\n    if (locatedMatchedEntityIds.length > 0) {\n      const [companyNameLinkRows, personNameLinkRows] = await Promise.all([\n        findWithDecryption(\n          em,\n          CustomerDealCompanyLink,\n          { company: { $in: locatedMatchedEntityIds } },\n          { fields: ['deal'] },\n          decryptionScope,\n        ),\n        findWithDecryption(\n          em,\n          CustomerDealPersonLink,\n          { person: { $in: locatedMatchedEntityIds } },\n          { fields: ['deal'] },\n          decryptionScope,\n        ),\n      ])\n      let nameMatchedDealIds = [\n        ...collectRefIds(companyNameLinkRows, 'deal'),\n        ...collectRefIds(personNameLinkRows, 'deal'),\n      ]\n      if (nameMatchedDealIds.length > 0) {\n        // The deal-field search in `buildDealListFilters` is intersected with the People/Companies\n        // association (and stuck/`?id`) filters \u2014 they all land together in `filters.id`. The name\n        // matches above carry NO such constraint, so unioning them raw would let a co-active\n        // People/Companies filter be bypassed (over-broad results). Recover exactly the non-search id\n        // allowlist by rebuilding the deal filters WITHOUT the search term, and intersect the name\n        // matches with it so the active filter is honored: located \u2229 nonSearch \u2229 (dealField \u222A name).\n        // (The map's query carries no advanced `filter[...]` params, so the consume-mutation in\n        // buildDealListFilters does not affect this second build.)\n        const nonSearchAllowlist = readFilterIdAllowlist(\n          await buildDealListFilters({ ...query, search: undefined }, ctx),\n        )\n        if (nonSearchAllowlist) {\n          const nonSearchLookup = new Set(nonSearchAllowlist)\n          nameMatchedDealIds = nameMatchedDealIds.filter((id) => nonSearchLookup.has(id))\n        }\n      }\n      if (nameMatchedDealIds.length > 0) {\n        searchAllowlist = Array.from(new Set([...(existingAllowlist ?? []), ...nameMatchedDealIds]))\n      }\n    }\n  }\n\n  const allowlistLookup = searchAllowlist ? new Set(searchAllowlist) : null\n  const restrictedDealIds = allowlistLookup\n    ? locatedDealIds.filter((id) => allowlistLookup.has(id))\n    : locatedDealIds\n  // `restrictedDealIds` is the final located \u2229 (deal-field \u222A company/person-name) set \u2014 it already\n  // captures every id constraint `buildDealListFilters` expressed (read back via\n  // `readFilterIdAllowlist`). Clear the stale `filters.id` first so `applyEntityIdRestriction` does\n  // not re-intersect against the deal-field \"no match\" sentinel and drop the name-matched deals.\n  delete (filters as Record<string, unknown>).id\n  applyEntityIdRestriction(filters, restrictedDealIds)\n\n  const sortColumn = query.sortField ? sortFieldMap[query.sortField] : 'id'\n  const sortDir = query.sortDir === 'desc' ? SortDir.Desc : SortDir.Asc\n  // Always append `id` as a stable tiebreaker \u2014 non-unique sort columns (title, value,\n  // probability, stage, or colliding timestamps) otherwise reorder between OFFSET pages and the\n  // client's multi-page accumulation would skip or duplicate deals at page boundaries.\n  const sort = sortColumn === 'id'\n    ? [{ field: 'id', dir: sortDir }]\n    : [{ field: sortColumn, dir: sortDir }, { field: 'id', dir: SortDir.Asc }]\n\n  const res = await queryEngine.query(E.customers.customer_deal, {\n    fields: [\n      'id',\n      // `organization_id` is projected (never exposed in the response) so the query engine can decrypt\n      // each row's encrypted fields (e.g. `title`) with the row's OWN org. Without it, an unrestricted\n      // \"All organizations\" scope has no single fallback org to decrypt with and titles come back as\n      // ciphertext \u2014 the List route projects it for the same reason (#3481).\n      'organization_id',\n      'title',\n      'status',\n      'pipeline_id',\n      'pipeline_stage_id',\n      'pipeline_stage',\n      'value_amount',\n      'value_currency',\n      'probability',\n      'expected_close_at',\n      'owner_user_id',\n      'updated_at',\n    ],\n    sort,\n    page: { page: query.page, pageSize: query.pageSize },\n    filters,\n    tenantId: effectiveTenantId,\n    organizationId: fallbackOrgId,\n    organizationIds: orgScopeIds ?? undefined,\n  })\n\n  const rows = (Array.isArray(res.items) ? res.items : []).filter(\n    (row): row is Record<string, unknown> => !!row && typeof row === 'object',\n  )\n  const dealIds = rows\n    .map((row) => (typeof row.id === 'string' && row.id.trim().length ? row.id : null))\n    .filter((value): value is string => value !== null)\n\n  // Heavy fetch, page-bounded: pull decrypted links (for labels) and coordinate-bearing addresses\n  // only for the deals on this page.\n  const [companyLinks, personLinks] = dealIds.length\n    ? await Promise.all([\n        findWithDecryption(\n          em,\n          CustomerDealCompanyLink,\n          { deal: { $in: dealIds } },\n          { populate: ['company'] },\n          decryptionScope,\n        ),\n        findWithDecryption(\n          em,\n          CustomerDealPersonLink,\n          { deal: { $in: dealIds } },\n          { populate: ['person'] },\n          decryptionScope,\n        ),\n      ])\n    : [[], []]\n\n  const companyRows = companyLinks\n    .map((link) => readLinkRow(link, link.company))\n    .filter((row): row is LinkRow => row !== null)\n  const personRows = personLinks\n    .map((link) => readLinkRow(link, link.person))\n    .filter((row): row is LinkRow => row !== null)\n  const companiesByDeal = groupAssociations(companyRows)\n  const peopleByDeal = groupAssociations(personRows)\n\n  const linkedEntityIds = Array.from(\n    new Set([...companyRows, ...personRows].map((row) => row.entityId)),\n  )\n  const addresses = linkedEntityIds.length\n    ? await findWithDecryption(\n        em,\n        CustomerAddress,\n        {\n          entity: { $in: linkedEntityIds },\n          latitude: { $ne: null },\n          longitude: { $ne: null },\n          tenantId: effectiveTenantId,\n          ...orgScopeFilter,\n        },\n        {},\n        decryptionScope,\n      )\n    : []\n\n  const addressRows: DealMapAddress[] = []\n  for (const address of addresses) {\n    const { id: entityId } = readEntityRef(address.entity)\n    if (!entityId) continue\n    addressRows.push({\n      id: address.id,\n      entityId,\n      isPrimary: address.isPrimary === true,\n      latitude: address.latitude ?? null,\n      longitude: address.longitude ?? null,\n      city: address.city ?? null,\n      region: address.region ?? null,\n      country: address.country ?? null,\n      createdAt: address.createdAt ?? null,\n    })\n  }\n\n  const toLink = (row: LinkRow): DealMapLink => ({\n    dealId: row.dealId,\n    entityId: row.entityId,\n    createdAt: row.createdAt,\n  })\n  const locationByDeal: Map<string, DealMapLocation | null> = resolveDealLocations(\n    dealIds,\n    companyRows.map(toLink),\n    personRows.map(toLink),\n    addressRows,\n  )\n\n  const items = rows\n    .map((row) => {\n      const id = typeof row.id === 'string' && row.id.trim().length ? row.id : null\n      if (!id) return null\n      return {\n        id,\n        title: toStringOrNull(row.title),\n        status: toStringOrNull(row.status),\n        pipelineId: toStringOrNull(row.pipeline_id),\n        pipelineStageId: toStringOrNull(row.pipeline_stage_id),\n        pipelineStage: toStringOrNull(row.pipeline_stage),\n        valueAmount: toFiniteNumberOrNull(row.value_amount),\n        valueCurrency: toStringOrNull(row.value_currency),\n        probability: toFiniteNumberOrNull(row.probability),\n        expectedCloseAt: toIsoStringOrNull(row.expected_close_at),\n        ownerUserId: toStringOrNull(row.owner_user_id),\n        updatedAt: toIsoStringOrNull(row.updated_at),\n        companies: companiesByDeal.get(id) ?? [],\n        people: peopleByDeal.get(id) ?? [],\n        location: locationByDeal.get(id) ?? null,\n      }\n    })\n    .filter((item): item is NonNullable<typeof item> => item !== null)\n\n  return NextResponse.json({\n    items,\n    total: res.total,\n    page: query.page,\n    pageSize: query.pageSize,\n    totalPages: Math.ceil(res.total / (query.pageSize || 1)),\n    ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AAEnD,SAAS,0BAA0B;AACnC,SAAS,eAAiC;AAE1C,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,0BAA0B,wDAAwD;AAC3F,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,OAIK;AACP,SAAS,SAAS;AAEX,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,2BAA2B,EAAE;AACnG;AAEA,MAAM,gBAAgB,CAAC,aAAa,aAAa,SAAS,SAAS,eAAe,iBAAiB;AAEnG,MAAM,eAA+D;AAAA,EACnE,WAAW;AAAA,EACX,WAAW;AAAA,EACX,OAAO;AAAA,EACP,OAAO;AAAA,EACP,aAAa;AAAA,EACb,iBAAiB;AACnB;AAEA,MAAM,cAAc,oBAAoB,OAAO;AAAA,EAC7C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,GAAG;AAAA,EACvD,WAAW,EAAE,KAAK,aAAa,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,MAAM,wBAAwB;AAAA,EAC3C,QAAQ,EAAE,MAAM,wBAAwB;AAAA,EACxC,UAAU,sBAAsB,SAAS;AAC3C,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,8BAA8B,iBAAiB,EAAE;AAAA,MAC9G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,eAAe;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,eAAe;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAWA,SAAS,cAAc,KAA6E;AAClG,MAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,IAAI,KAAK,QAAQ,KAAK;AAC5D,MAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,UAAM,SAAS;AACf,WAAO,EAAE,IAAI,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK,MAAM,OAAO;AAAA,EACxE;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AAClC;AAEA,SAAS,YAAY,MAA2D,WAAoC;AAClH,QAAM,EAAE,IAAI,OAAO,IAAI,cAAc,KAAK,IAAI;AAC9C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,IAAI,UAAU,OAAO,IAAI,cAAc,SAAS;AACxD,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,QAAQ,UAAU,OAAO,OAAO,gBAAgB,WAAW,OAAO,cAAc;AACtF,SAAO,EAAE,QAAQ,UAAU,OAAO,WAAW,KAAK,aAAa,KAAK;AACtE;AAEA,SAAS,kBAAkB,MAAoD;AAC7E,QAAM,SAAS,oBAAI,IAAkC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,MAAM,KAAK,CAAC;AAC1C,QAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,IAAI,QAAQ,GAAG;AACtD,aAAO,KAAK,EAAE,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,CAAC;AAClD,aAAO,IAAI,IAAI,QAAQ,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,GAAG;AACxD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA+B;AACxD,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,eAAe,KAAK;AAC7B;AAEA,SAAS,eAAe,cAA+B,KAA8B;AACnF,QAAM,SAAS,mBAAmB,cAAc,GAAG;AACnD,SAAO,OAAO,SAAS,SAAS;AAClC;AAEA,SAAS,cAAc,MAAiB,KAAuB;AAC7D,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,EAAE,GAAG,IAAI,cAAe,IAAgC,GAAG,CAAC;AAClE,QAAI,GAAI,KAAI,IAAI,EAAE;AAAA,EACpB;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAKA,SAAS,sBAAsB,SAAmD;AAChF,QAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC,OAAO,GAAG;AACtD,MAAI,MAAM,QAAQ,OAAO,GAAG,EAAG,QAAO,OAAO,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC7G,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAc,UAAkB;AACxD,SAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AACjF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI;AACnB,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC5B,UAAU,OAAO,IAAI,UAAU,KAAK;AAAA,IACpC,QAAQ,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChC,QAAQ,eAAe,QAAQ,QAAQ,KAAK;AAAA,IAC5C,YAAY,eAAe,QAAQ,YAAY,KAAK;AAAA,IACpD,iBAAiB,OAAO,IAAI,iBAAiB,KAAK;AAAA,IAClD,aAAa,eAAe,QAAQ,aAAa,KAAK;AAAA,IACtD,UAAU,eAAe,QAAQ,UAAU,KAAK;AAAA,IAChD,WAAW,eAAe,QAAQ,WAAW,KAAK;AAAA,IAClD,eAAe,eAAe,QAAQ,eAAe,KAAK;AAAA,IAC1D,qBAAqB,OAAO,IAAI,qBAAqB,KAAK;AAAA,IAC1D,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,IACtD,SAAS,OAAO,IAAI,SAAS,KAAK;AAAA,IAClC,WAAW,OAAO,IAAI,WAAW,KAAK;AAAA,IACtC,WAAW,OAAO,IAAI,WAAW,KAAK;AAAA,IACtC,SAAS,OAAO,IAAI,SAAS,KAAK;AAAA,EACpC,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,QAAQ,OAAO;AAErB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,cAAc,UAAU,QAAqB,aAAa;AAEhE,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,oBAAoB,MAAM,YAAY,KAAK;AAMjD,QAAM,cACJ,MAAM,cAAc,OAChB,OACA,MAAM,QAAQ,MAAM,SAAS,KAAK,MAAM,UAAU,SAAS,IACzD,MAAM,KAAK,IAAI,IAAI,MAAM,UAAU,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,IAC3F,KAAK,QACH,CAAC,KAAK,KAAK,IACX,CAAC;AACX,MAAI,CAAC,qBAAsB,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,GAAI;AAClF,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAIA,QAAM,iBAAiB,cAAc,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,IAAI,CAAC;AACjF,QAAM,gBAAgB,eAAe,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI;AAM/E,QAAM,kBAAkB,EAAE,UAAU,mBAAmB,gBAAgB,cAAc;AAOrF,QAAM,uBAAuB,MAAM;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,EAAE,KAAK,KAAK;AAAA,MACtB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AAAA,IACA,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,IACrB;AAAA,EACF;AACA,QAAM,mBAAmB,cAAc,sBAAsB,QAAQ;AACrE,MAAI,iBAAiB,WAAW,GAAG;AACjC,WAAO,iBAAiB,MAAM,MAAM,MAAM,QAAQ;AAAA,EACpD;AAEA,QAAM,CAAC,wBAAwB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxE;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,SAAS,EAAE,KAAK,iBAAiB,EAAE;AAAA,MACrC,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,MACnB;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,EAAE,KAAK,iBAAiB,EAAE;AAAA,MACpC,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,MAAM;AAAA,IAC3B,oBAAI,IAAI;AAAA,MACN,GAAG,cAAc,wBAAwB,MAAM;AAAA,MAC/C,GAAG,cAAc,uBAAuB,MAAM;AAAA,IAChD,CAAC;AAAA,EACH;AACA,MAAI,eAAe,WAAW,GAAG;AAC/B,WAAO,iBAAiB,MAAM,MAAM,MAAM,QAAQ;AAAA,EACpD;AAEA,QAAM,MAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,iBAAiB;AAAA,IACzC,iBAAiB;AAAA,IACjB,SAAS;AAAA,EACX;AAEA,QAAM,UAAU,MAAM,qBAAqB,OAAO,GAAG;AACrD,QAAM,oBAAoB,sBAAsB,OAAO;AAQvD,MAAI,kBAAkB;AACtB,MAAI,MAAM,UAAU,iBAAiB,SAAS,GAAG;AAC/C,UAAM,uBAAuB,MAAM,iDAAiD;AAAA,MAClF;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS;AAAA,QACP;AAAA,UACE,YAAY,EAAE,UAAU;AAAA,UACxB,QAAQ,CAAC,gBAAgB,iBAAiB,iBAAiB,aAAa;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,UAAM,2BAA2B,wBAAwB,CAAC,GAAG,OAAO,CAAC,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACpG,QAAI,wBAAwB,SAAS,GAAG;AACtC,YAAM,CAAC,qBAAqB,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAClE;AAAA,UACE;AAAA,UACA;AAAA,UACA,EAAE,SAAS,EAAE,KAAK,wBAAwB,EAAE;AAAA,UAC5C,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,UACnB;AAAA,QACF;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,EAAE,KAAK,wBAAwB,EAAE;AAAA,UAC3C,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,UACnB;AAAA,QACF;AAAA,MACF,CAAC;AACD,UAAI,qBAAqB;AAAA,QACvB,GAAG,cAAc,qBAAqB,MAAM;AAAA,QAC5C,GAAG,cAAc,oBAAoB,MAAM;AAAA,MAC7C;AACA,UAAI,mBAAmB,SAAS,GAAG;AASjC,cAAM,qBAAqB;AAAA,UACzB,MAAM,qBAAqB,EAAE,GAAG,OAAO,QAAQ,OAAU,GAAG,GAAG;AAAA,QACjE;AACA,YAAI,oBAAoB;AACtB,gBAAM,kBAAkB,IAAI,IAAI,kBAAkB;AAClD,+BAAqB,mBAAmB,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,CAAC;AAAA,QAChF;AAAA,MACF;AACA,UAAI,mBAAmB,SAAS,GAAG;AACjC,0BAAkB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,qBAAqB,CAAC,GAAI,GAAG,kBAAkB,CAAC,CAAC;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,kBAAkB,kBAAkB,IAAI,IAAI,eAAe,IAAI;AACrE,QAAM,oBAAoB,kBACtB,eAAe,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,CAAC,IACrD;AAKJ,SAAQ,QAAoC;AAC5C,2BAAyB,SAAS,iBAAiB;AAEnD,QAAM,aAAa,MAAM,YAAY,aAAa,MAAM,SAAS,IAAI;AACrE,QAAM,UAAU,MAAM,YAAY,SAAS,QAAQ,OAAO,QAAQ;AAIlE,QAAM,OAAO,eAAe,OACxB,CAAC,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,IAC9B,CAAC,EAAE,OAAO,YAAY,KAAK,QAAQ,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC;AAE3E,QAAM,MAAM,MAAM,YAAY,MAAM,EAAE,UAAU,eAAe;AAAA,IAC7D,QAAQ;AAAA,MACN;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,IACA,MAAM,EAAE,MAAM,MAAM,MAAM,UAAU,MAAM,SAAS;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,iBAAiB,eAAe;AAAA,EAClC,CAAC;AAED,QAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG;AAAA,IACvD,CAAC,QAAwC,CAAC,CAAC,OAAO,OAAO,QAAQ;AAAA,EACnE;AACA,QAAM,UAAU,KACb,IAAI,CAAC,QAAS,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK,IAAK,EACjF,OAAO,CAAC,UAA2B,UAAU,IAAI;AAIpD,QAAM,CAAC,cAAc,WAAW,IAAI,QAAQ,SACxC,MAAM,QAAQ,IAAI;AAAA,IAChB;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE;AAAA,MACzB,EAAE,UAAU,CAAC,SAAS,EAAE;AAAA,MACxB;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE;AAAA,MACzB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAAA,EACF,CAAC,IACD,CAAC,CAAC,GAAG,CAAC,CAAC;AAEX,QAAM,cAAc,aACjB,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,OAAO,CAAC,EAC7C,OAAO,CAAC,QAAwB,QAAQ,IAAI;AAC/C,QAAM,aAAa,YAChB,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,MAAM,CAAC,EAC5C,OAAO,CAAC,QAAwB,QAAQ,IAAI;AAC/C,QAAM,kBAAkB,kBAAkB,WAAW;AACrD,QAAM,eAAe,kBAAkB,UAAU;AAEjD,QAAM,kBAAkB,MAAM;AAAA,IAC5B,IAAI,IAAI,CAAC,GAAG,aAAa,GAAG,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAAA,EACpE;AACA,QAAM,YAAY,gBAAgB,SAC9B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,QAAQ,EAAE,KAAK,gBAAgB;AAAA,MAC/B,UAAU,EAAE,KAAK,KAAK;AAAA,MACtB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AAEL,QAAM,cAAgC,CAAC;AACvC,aAAW,WAAW,WAAW;AAC/B,UAAM,EAAE,IAAI,SAAS,IAAI,cAAc,QAAQ,MAAM;AACrD,QAAI,CAAC,SAAU;AACf,gBAAY,KAAK;AAAA,MACf,IAAI,QAAQ;AAAA,MACZ;AAAA,MACA,WAAW,QAAQ,cAAc;AAAA,MACjC,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,MAChC,MAAM,QAAQ,QAAQ;AAAA,MACtB,QAAQ,QAAQ,UAAU;AAAA,MAC1B,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,CAAC,SAA+B;AAAA,IAC7C,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,WAAW,IAAI;AAAA,EACjB;AACA,QAAM,iBAAsD;AAAA,IAC1D;AAAA,IACA,YAAY,IAAI,MAAM;AAAA,IACtB,WAAW,IAAI,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,QAAQ,KACX,IAAI,CAAC,QAAQ;AACZ,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK;AACzE,QAAI,CAAC,GAAI,QAAO;AAChB,WAAO;AAAA,MACL;AAAA,MACA,OAAO,eAAe,IAAI,KAAK;AAAA,MAC/B,QAAQ,eAAe,IAAI,MAAM;AAAA,MACjC,YAAY,eAAe,IAAI,WAAW;AAAA,MAC1C,iBAAiB,eAAe,IAAI,iBAAiB;AAAA,MACrD,eAAe,eAAe,IAAI,cAAc;AAAA,MAChD,aAAa,qBAAqB,IAAI,YAAY;AAAA,MAClD,eAAe,eAAe,IAAI,cAAc;AAAA,MAChD,aAAa,qBAAqB,IAAI,WAAW;AAAA,MACjD,iBAAiB,kBAAkB,IAAI,iBAAiB;AAAA,MACxD,aAAa,eAAe,IAAI,aAAa;AAAA,MAC7C,WAAW,kBAAkB,IAAI,UAAU;AAAA,MAC3C,WAAW,gBAAgB,IAAI,EAAE,KAAK,CAAC;AAAA,MACvC,QAAQ,aAAa,IAAI,EAAE,KAAK,CAAC;AAAA,MACjC,UAAU,eAAe,IAAI,EAAE,KAAK;AAAA,IACtC;AAAA,EACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAEnE,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,OAAO,IAAI;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,IAAI,SAAS,MAAM,YAAY,EAAE;AAAA,IACvD,GAAI,IAAI,MAAM,sBAAsB,EAAE,eAAe,KAAK,IAAI,CAAC;AAAA,EACjE,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'\nimport { readQueryParamList } from '@open-mercato/shared/lib/crud/query-params'\nimport { SortDir, type QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  CustomerAddress,\n  CustomerDealCompanyLink,\n  CustomerDealPersonLink,\n} from '../../../data/entities'\nimport { buildDealListFilters, dealListQuerySchema } from '../route'\nimport { applyEntityIdRestriction, findMatchingEntityIdsBySearchTokensAcrossSources } from '../../utils'\nimport { createPagedListResponseSchema } from '../../openapi'\nimport {\n  resolveDealLocations,\n  type DealMapAddress,\n  type DealMapLink,\n  type DealMapLocation,\n} from '../../../lib/dealsMapLocation'\nimport { E } from '#generated/entities.ids.generated'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view', 'customers.activities.view'] },\n}\n\nconst mapSortFields = ['createdAt', 'updatedAt', 'title', 'value', 'probability', 'expectedCloseAt'] as const\n\nconst sortFieldMap: Record<(typeof mapSortFields)[number], string> = {\n  createdAt: 'created_at',\n  updatedAt: 'updated_at',\n  title: 'title',\n  value: 'value_amount',\n  probability: 'probability',\n  expectedCloseAt: 'expected_close_at',\n}\n\nconst querySchema = dealListQuerySchema.extend({\n  pageSize: z.coerce.number().min(1).max(100).default(100),\n  sortField: z.enum(mapSortFields).optional(),\n})\n\nconst dealMapAssociationSchema = z.object({\n  id: z.string().uuid(),\n  label: z.string().nullable(),\n})\n\nconst dealMapLocationSchema = z.object({\n  latitude: z.number(),\n  longitude: z.number(),\n  city: z.string().nullable(),\n  region: z.string().nullable(),\n  country: z.string().nullable(),\n  source: z.enum(['company', 'person']),\n  entityId: z.string().uuid(),\n  addressId: z.string().uuid(),\n})\n\nconst dealMapItemSchema = z.object({\n  id: z.string().uuid(),\n  title: z.string().nullable(),\n  status: z.string().nullable(),\n  pipelineId: z.string().uuid().nullable(),\n  pipelineStageId: z.string().uuid().nullable(),\n  pipelineStage: z.string().nullable(),\n  valueAmount: z.number().nullable(),\n  valueCurrency: z.string().nullable(),\n  probability: z.number().nullable(),\n  expectedCloseAt: z.string().nullable(),\n  ownerUserId: z.string().uuid().nullable(),\n  updatedAt: z.string().nullable(),\n  companies: z.array(dealMapAssociationSchema),\n  people: z.array(dealMapAssociationSchema),\n  location: dealMapLocationSchema.nullable(),\n})\n\nconst mapErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Deals map listing with resolved locations',\n  methods: {\n    GET: {\n      summary: 'Paginated deals that have a resolvable map location',\n      description:\n        'Returns a page of deals that have a coordinate-bearing linked company/person address, each enriched with one resolved location (company primary first, then earliest created; person addresses as fallback). Deals with no coordinate-bearing address are excluded entirely, so every item carries a non-null location in normal operation; the schema keeps location nullable only for the rare case where the address is deleted between the located-deal resolution and the page fetch.',\n      query: querySchema,\n      responses: [\n        { status: 200, description: 'Paged located deals', schema: createPagedListResponseSchema(dealMapItemSchema) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: mapErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: mapErrorSchema },\n        { status: 403, description: 'Missing required features', schema: mapErrorSchema },\n      ],\n    },\n  },\n}\n\ntype DealMapAssociation = z.infer<typeof dealMapAssociationSchema>\n\ntype LinkRow = {\n  dealId: string\n  entityId: string\n  label: string\n  createdAt: Date | string | null\n}\n\nfunction readEntityRef(ref: unknown): { id: string | null; record: Record<string, unknown> | null } {\n  if (typeof ref === 'string') return { id: ref, record: null }\n  if (ref && typeof ref === 'object') {\n    const record = ref as Record<string, unknown>\n    return { id: typeof record.id === 'string' ? record.id : null, record }\n  }\n  return { id: null, record: null }\n}\n\nfunction readLinkRow(link: { deal: unknown; createdAt?: Date | string | null }, linkedRef: unknown): LinkRow | null {\n  const { id: dealId } = readEntityRef(link.deal)\n  if (!dealId) return null\n  const { id: entityId, record } = readEntityRef(linkedRef)\n  if (!entityId) return null\n  const label = record && typeof record.displayName === 'string' ? record.displayName : ''\n  return { dealId, entityId, label, createdAt: link.createdAt ?? null }\n}\n\nfunction groupAssociations(rows: LinkRow[]): Map<string, DealMapAssociation[]> {\n  const byDeal = new Map<string, DealMapAssociation[]>()\n  for (const row of rows) {\n    const bucket = byDeal.get(row.dealId) ?? []\n    if (!bucket.some((entry) => entry.id === row.entityId)) {\n      bucket.push({ id: row.entityId, label: row.label })\n      byDeal.set(row.dealId, bucket)\n    }\n  }\n  return byDeal\n}\n\nfunction toStringOrNull(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction toFiniteNumberOrNull(value: unknown): number | null {\n  if (typeof value === 'number') return Number.isFinite(value) ? value : null\n  if (typeof value === 'string' && value.trim().length > 0) {\n    const parsed = Number(value)\n    return Number.isFinite(parsed) ? parsed : null\n  }\n  return null\n}\n\nfunction toIsoStringOrNull(value: unknown): string | null {\n  if (value instanceof Date) return value.toISOString()\n  return toStringOrNull(value)\n}\n\nfunction readArrayParam(searchParams: URLSearchParams, key: string): string[] | null {\n  const values = readQueryParamList(searchParams, key)\n  return values.length ? values : null\n}\n\nfunction collectRefIds(rows: unknown[], key: string): string[] {\n  const ids = new Set<string>()\n  for (const row of rows) {\n    if (!row || typeof row !== 'object') continue\n    const { id } = readEntityRef((row as Record<string, unknown>)[key])\n    if (id) ids.add(id)\n  }\n  return Array.from(ids)\n}\n\n// The deal-list filter builder may already restrict `id` (search, association, stuck, or advanced\n// filters). `applyEntityIdRestriction` overwrites an existing `$in`, so intersect the located-deal\n// set with whatever allow-list is already present before re-applying it.\nfunction readFilterIdAllowlist(filters: Record<string, unknown>): string[] | null {\n  const idFilter = filters.id\n  if (!idFilter || typeof idFilter !== 'object' || Array.isArray(idFilter)) return null\n  const record = idFilter as { $eq?: unknown; $in?: unknown }\n  if (typeof record.$eq === 'string') return [record.$eq]\n  if (Array.isArray(record.$in)) return record.$in.filter((value): value is string => typeof value === 'string')\n  return null\n}\n\nfunction emptyMapResponse(page: number, pageSize: number) {\n  return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 })\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const url = new URL(req.url)\n  const params = url.searchParams\n  const parsed = querySchema.safeParse({\n    page: params.get('page') ?? undefined,\n    pageSize: params.get('pageSize') ?? undefined,\n    search: params.get('search') ?? undefined,\n    status: readArrayParam(params, 'status') ?? undefined,\n    pipelineId: readArrayParam(params, 'pipelineId') ?? undefined,\n    pipelineStageId: params.get('pipelineStageId') ?? undefined,\n    ownerUserId: readArrayParam(params, 'ownerUserId') ?? undefined,\n    personId: readArrayParam(params, 'personId') ?? undefined,\n    companyId: readArrayParam(params, 'companyId') ?? undefined,\n    valueCurrency: readArrayParam(params, 'valueCurrency') ?? undefined,\n    expectedCloseAtFrom: params.get('expectedCloseAtFrom') ?? undefined,\n    expectedCloseAtTo: params.get('expectedCloseAtTo') ?? undefined,\n    isStuck: params.get('isStuck') ?? undefined,\n    isOverdue: params.get('isOverdue') ?? undefined,\n    sortField: params.get('sortField') ?? undefined,\n    sortDir: params.get('sortDir') ?? undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n  }\n  const query = parsed.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve<EntityManager>('em')\n  const queryEngine = container.resolve<QueryEngine>('queryEngine')\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const effectiveTenantId = scope.tenantId ?? auth.tenantId\n  // `null` = unrestricted access (superadmin or an \"all organizations\" grant): aggregate tenant-wide,\n  // exactly like the deals List route (`makeCrudRoute`) and the query_index status route. A populated\n  // array bounds the query to the caller's visible orgs; an empty array means no org visibility and\n  // returns an empty page without touching any data source.\n  // The previous guard hard-required `auth.orgId`, which is empty under the header \"All organizations\"\n  // scope, so the map 401'd (and hung on the loading spinner) while List/Kanban aggregated fine (#3481).\n  const { organizationIds } = resolveOrganizationScopeFilter(scope, auth)\n  const orgScopeIds = organizationIds === undefined\n    ? null\n    : Array.from(new Set(organizationIds.filter((id) => typeof id === 'string' && id.length > 0)))\n  if (!effectiveTenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  if (orgScopeIds?.length === 0) {\n    return emptyMapResponse(query.page, query.pageSize)\n  }\n\n  // Bounded `$in` when the caller is org-restricted; omitted entirely under unrestricted access so\n  // every query stays tenant-scoped only. `fallbackOrgId` is undefined when unrestricted.\n  const orgScopeFilter = orgScopeIds ? { organizationId: { $in: orgScopeIds } } : {}\n  const fallbackOrgId = orgScopeIds && orgScopeIds.length > 0 ? orgScopeIds[0] : undefined\n\n  // `findWithDecryption` decrypts each row with the row's OWN tenant/organization (the encryption\n  // subscriber's resolveScope(target) wins); this scope is only a fallback for rows that carry no\n  // scope columns. CustomerAddress always carries organization_id, so every org's rows still decrypt\n  // correctly under a multi-org / unrestricted scope even though `fallbackOrgId` may be undefined.\n  const decryptionScope = { tenantId: effectiveTenantId, organizationId: fallbackOrgId }\n\n  // Located-only, resolved in two stages so the per-request cost stays page-bounded:\n  // 1) LIGHT id-only queries (FK columns only, no decryption) determine which deals have a\n  //    coordinate-bearing linked company/person, so pagination + `total` operate on located deals.\n  // 2) The HEAVY decrypted/populated fetch (labels + address coordinates) runs only for the deals\n  //    that actually land on the requested page \u2014 never the whole located universe.\n  const coordinateEntityRows = await findWithDecryption(\n    em,\n    CustomerAddress,\n    {\n      latitude: { $ne: null },\n      longitude: { $ne: null },\n      tenantId: effectiveTenantId,\n      ...orgScopeFilter,\n    },\n    { fields: ['entity'] },\n    decryptionScope,\n  )\n  const locatedEntityIds = collectRefIds(coordinateEntityRows, 'entity')\n  if (locatedEntityIds.length === 0) {\n    return emptyMapResponse(query.page, query.pageSize)\n  }\n\n  const [locatedCompanyLinkRows, locatedPersonLinkRows] = await Promise.all([\n    findWithDecryption(\n      em,\n      CustomerDealCompanyLink,\n      { company: { $in: locatedEntityIds } },\n      { fields: ['deal'] },\n      decryptionScope,\n    ),\n    findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { person: { $in: locatedEntityIds } },\n      { fields: ['deal'] },\n      decryptionScope,\n    ),\n  ])\n  const locatedDealIds = Array.from(\n    new Set([\n      ...collectRefIds(locatedCompanyLinkRows, 'deal'),\n      ...collectRefIds(locatedPersonLinkRows, 'deal'),\n    ]),\n  )\n  if (locatedDealIds.length === 0) {\n    return emptyMapResponse(query.page, query.pageSize)\n  }\n\n  const ctx: CrudCtx = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: fallbackOrgId ?? null,\n    organizationIds: orgScopeIds,\n    request: req,\n  }\n\n  const filters = await buildDealListFilters(query, ctx)\n  const existingAllowlist = readFilterIdAllowlist(filters)\n\n  // The map card headline is the linked company/person name, which the deal-field token search\n  // (title/description/status/\u2026) used by `buildDealListFilters` does NOT cover \u2014 so searching a\n  // company/person name a user can plainly see on a card would otherwise return nothing. When a\n  // search term is present, also resolve located deals whose linked company/person ENTITY name\n  // matches, and union them with the deal-field matches. The sentinel \"no match\" id from the\n  // deal-field search drops out naturally at the located intersection below, so no special-casing.\n  let searchAllowlist = existingAllowlist\n  if (query.search && locatedEntityIds.length > 0) {\n    const nameMatchedEntityIds = await findMatchingEntityIdsBySearchTokensAcrossSources({\n      ctx,\n      query: query.search,\n      sources: [\n        {\n          entityType: E.customers.customer_entity,\n          fields: ['display_name', 'primary_email', 'primary_phone', 'description'],\n        },\n      ],\n    })\n    const locatedEntitySet = new Set(locatedEntityIds)\n    const locatedMatchedEntityIds = (nameMatchedEntityIds ?? []).filter((id) => locatedEntitySet.has(id))\n    if (locatedMatchedEntityIds.length > 0) {\n      const [companyNameLinkRows, personNameLinkRows] = await Promise.all([\n        findWithDecryption(\n          em,\n          CustomerDealCompanyLink,\n          { company: { $in: locatedMatchedEntityIds } },\n          { fields: ['deal'] },\n          decryptionScope,\n        ),\n        findWithDecryption(\n          em,\n          CustomerDealPersonLink,\n          { person: { $in: locatedMatchedEntityIds } },\n          { fields: ['deal'] },\n          decryptionScope,\n        ),\n      ])\n      let nameMatchedDealIds = [\n        ...collectRefIds(companyNameLinkRows, 'deal'),\n        ...collectRefIds(personNameLinkRows, 'deal'),\n      ]\n      if (nameMatchedDealIds.length > 0) {\n        // The deal-field search in `buildDealListFilters` is intersected with the People/Companies\n        // association (and stuck/`?id`) filters \u2014 they all land together in `filters.id`. The name\n        // matches above carry NO such constraint, so unioning them raw would let a co-active\n        // People/Companies filter be bypassed (over-broad results). Recover exactly the non-search id\n        // allowlist by rebuilding the deal filters WITHOUT the search term, and intersect the name\n        // matches with it so the active filter is honored: located \u2229 nonSearch \u2229 (dealField \u222A name).\n        // (The map's query carries no advanced `filter[...]` params, so the consume-mutation in\n        // buildDealListFilters does not affect this second build.)\n        const nonSearchAllowlist = readFilterIdAllowlist(\n          await buildDealListFilters({ ...query, search: undefined }, ctx),\n        )\n        if (nonSearchAllowlist) {\n          const nonSearchLookup = new Set(nonSearchAllowlist)\n          nameMatchedDealIds = nameMatchedDealIds.filter((id) => nonSearchLookup.has(id))\n        }\n      }\n      if (nameMatchedDealIds.length > 0) {\n        searchAllowlist = Array.from(new Set([...(existingAllowlist ?? []), ...nameMatchedDealIds]))\n      }\n    }\n  }\n\n  const allowlistLookup = searchAllowlist ? new Set(searchAllowlist) : null\n  const restrictedDealIds = allowlistLookup\n    ? locatedDealIds.filter((id) => allowlistLookup.has(id))\n    : locatedDealIds\n  // `restrictedDealIds` is the final located \u2229 (deal-field \u222A company/person-name) set \u2014 it already\n  // captures every id constraint `buildDealListFilters` expressed (read back via\n  // `readFilterIdAllowlist`). Clear the stale `filters.id` first so `applyEntityIdRestriction` does\n  // not re-intersect against the deal-field \"no match\" sentinel and drop the name-matched deals.\n  delete (filters as Record<string, unknown>).id\n  applyEntityIdRestriction(filters, restrictedDealIds)\n\n  const sortColumn = query.sortField ? sortFieldMap[query.sortField] : 'id'\n  const sortDir = query.sortDir === 'desc' ? SortDir.Desc : SortDir.Asc\n  // Always append `id` as a stable tiebreaker \u2014 non-unique sort columns (title, value,\n  // probability, stage, or colliding timestamps) otherwise reorder between OFFSET pages and the\n  // client's multi-page accumulation would skip or duplicate deals at page boundaries.\n  const sort = sortColumn === 'id'\n    ? [{ field: 'id', dir: sortDir }]\n    : [{ field: sortColumn, dir: sortDir }, { field: 'id', dir: SortDir.Asc }]\n\n  const res = await queryEngine.query(E.customers.customer_deal, {\n    fields: [\n      'id',\n      // `organization_id` is projected (never exposed in the response) so the query engine can decrypt\n      // each row's encrypted fields (e.g. `title`) with the row's OWN org. Without it, an unrestricted\n      // \"All organizations\" scope has no single fallback org to decrypt with and titles come back as\n      // ciphertext \u2014 the List route projects it for the same reason (#3481).\n      'organization_id',\n      'title',\n      'status',\n      'pipeline_id',\n      'pipeline_stage_id',\n      'pipeline_stage',\n      'value_amount',\n      'value_currency',\n      'probability',\n      'expected_close_at',\n      'owner_user_id',\n      'updated_at',\n    ],\n    sort,\n    page: { page: query.page, pageSize: query.pageSize },\n    filters,\n    tenantId: effectiveTenantId,\n    organizationId: fallbackOrgId,\n    organizationIds: orgScopeIds ?? undefined,\n  })\n\n  const rows = (Array.isArray(res.items) ? res.items : []).filter(\n    (row): row is Record<string, unknown> => !!row && typeof row === 'object',\n  )\n  const dealIds = rows\n    .map((row) => (typeof row.id === 'string' && row.id.trim().length ? row.id : null))\n    .filter((value): value is string => value !== null)\n\n  // Heavy fetch, page-bounded: pull decrypted links (for labels) and coordinate-bearing addresses\n  // only for the deals on this page.\n  const [companyLinks, personLinks] = dealIds.length\n    ? await Promise.all([\n        findWithDecryption(\n          em,\n          CustomerDealCompanyLink,\n          { deal: { $in: dealIds } },\n          { populate: ['company'] },\n          decryptionScope,\n        ),\n        findWithDecryption(\n          em,\n          CustomerDealPersonLink,\n          { deal: { $in: dealIds } },\n          { populate: ['person'] },\n          decryptionScope,\n        ),\n      ])\n    : [[], []]\n\n  const companyRows = companyLinks\n    .map((link) => readLinkRow(link, link.company))\n    .filter((row): row is LinkRow => row !== null)\n  const personRows = personLinks\n    .map((link) => readLinkRow(link, link.person))\n    .filter((row): row is LinkRow => row !== null)\n  const companiesByDeal = groupAssociations(companyRows)\n  const peopleByDeal = groupAssociations(personRows)\n\n  const linkedEntityIds = Array.from(\n    new Set([...companyRows, ...personRows].map((row) => row.entityId)),\n  )\n  const addresses = linkedEntityIds.length\n    ? await findWithDecryption(\n        em,\n        CustomerAddress,\n        {\n          entity: { $in: linkedEntityIds },\n          latitude: { $ne: null },\n          longitude: { $ne: null },\n          tenantId: effectiveTenantId,\n          ...orgScopeFilter,\n        },\n        {},\n        decryptionScope,\n      )\n    : []\n\n  const addressRows: DealMapAddress[] = []\n  for (const address of addresses) {\n    const { id: entityId } = readEntityRef(address.entity)\n    if (!entityId) continue\n    addressRows.push({\n      id: address.id,\n      entityId,\n      isPrimary: address.isPrimary === true,\n      latitude: address.latitude ?? null,\n      longitude: address.longitude ?? null,\n      city: address.city ?? null,\n      region: address.region ?? null,\n      country: address.country ?? null,\n      createdAt: address.createdAt ?? null,\n    })\n  }\n\n  const toLink = (row: LinkRow): DealMapLink => ({\n    dealId: row.dealId,\n    entityId: row.entityId,\n    createdAt: row.createdAt,\n  })\n  const locationByDeal: Map<string, DealMapLocation | null> = resolveDealLocations(\n    dealIds,\n    companyRows.map(toLink),\n    personRows.map(toLink),\n    addressRows,\n  )\n\n  const items = rows\n    .map((row) => {\n      const id = typeof row.id === 'string' && row.id.trim().length ? row.id : null\n      if (!id) return null\n      return {\n        id,\n        title: toStringOrNull(row.title),\n        status: toStringOrNull(row.status),\n        pipelineId: toStringOrNull(row.pipeline_id),\n        pipelineStageId: toStringOrNull(row.pipeline_stage_id),\n        pipelineStage: toStringOrNull(row.pipeline_stage),\n        valueAmount: toFiniteNumberOrNull(row.value_amount),\n        valueCurrency: toStringOrNull(row.value_currency),\n        probability: toFiniteNumberOrNull(row.probability),\n        expectedCloseAt: toIsoStringOrNull(row.expected_close_at),\n        ownerUserId: toStringOrNull(row.owner_user_id),\n        updatedAt: toIsoStringOrNull(row.updated_at),\n        companies: companiesByDeal.get(id) ?? [],\n        people: peopleByDeal.get(id) ?? [],\n        location: locationByDeal.get(id) ?? null,\n      }\n    })\n    .filter((item): item is NonNullable<typeof item> => item !== null)\n\n  return NextResponse.json({\n    items,\n    total: res.total,\n    page: query.page,\n    pageSize: query.pageSize,\n    totalPages: Math.ceil(res.total / (query.pageSize || 1)),\n    ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAE/C,SAAS,0BAA0B;AACnC,SAAS,eAAiC;AAE1C,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,0BAA0B,wDAAwD;AAC3F,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,OAIK;AACP,SAAS,SAAS;AAEX,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,2BAA2B,EAAE;AACnG;AAEA,MAAM,gBAAgB,CAAC,aAAa,aAAa,SAAS,SAAS,eAAe,iBAAiB;AAEnG,MAAM,eAA+D;AAAA,EACnE,WAAW;AAAA,EACX,WAAW;AAAA,EACX,OAAO;AAAA,EACP,OAAO;AAAA,EACP,aAAa;AAAA,EACb,iBAAiB;AACnB;AAEA,MAAM,cAAc,oBAAoB,OAAO;AAAA,EAC7C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,GAAG;AAAA,EACvD,WAAW,EAAE,KAAK,aAAa,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAC7B,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,QAAQ,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,MAAM,wBAAwB;AAAA,EAC3C,QAAQ,EAAE,MAAM,wBAAwB;AAAA,EACxC,UAAU,sBAAsB,SAAS;AAC3C,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,8BAA8B,iBAAiB,EAAE;AAAA,MAC9G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,eAAe;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,eAAe;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,eAAe;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAWA,SAAS,cAAc,KAA6E;AAClG,MAAI,OAAO,QAAQ,SAAU,QAAO,EAAE,IAAI,KAAK,QAAQ,KAAK;AAC5D,MAAI,OAAO,OAAO,QAAQ,UAAU;AAClC,UAAM,SAAS;AACf,WAAO,EAAE,IAAI,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK,MAAM,OAAO;AAAA,EACxE;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ,KAAK;AAClC;AAEA,SAAS,YAAY,MAA2D,WAAoC;AAClH,QAAM,EAAE,IAAI,OAAO,IAAI,cAAc,KAAK,IAAI;AAC9C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,EAAE,IAAI,UAAU,OAAO,IAAI,cAAc,SAAS;AACxD,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,QAAQ,UAAU,OAAO,OAAO,gBAAgB,WAAW,OAAO,cAAc;AACtF,SAAO,EAAE,QAAQ,UAAU,OAAO,WAAW,KAAK,aAAa,KAAK;AACtE;AAEA,SAAS,kBAAkB,MAAoD;AAC7E,QAAM,SAAS,oBAAI,IAAkC;AACrD,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,OAAO,IAAI,IAAI,MAAM,KAAK,CAAC;AAC1C,QAAI,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,OAAO,IAAI,QAAQ,GAAG;AACtD,aAAO,KAAK,EAAE,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,CAAC;AAClD,aAAO,IAAI,IAAI,QAAQ,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA+B;AACrD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,GAAG;AACxD,UAAM,SAAS,OAAO,KAAK;AAC3B,WAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAA+B;AACxD,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,SAAO,eAAe,KAAK;AAC7B;AAEA,SAAS,eAAe,cAA+B,KAA8B;AACnF,QAAM,SAAS,mBAAmB,cAAc,GAAG;AACnD,SAAO,OAAO,SAAS,SAAS;AAClC;AAEA,SAAS,cAAc,MAAiB,KAAuB;AAC7D,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,OAAO,OAAO,QAAQ,SAAU;AACrC,UAAM,EAAE,GAAG,IAAI,cAAe,IAAgC,GAAG,CAAC;AAClE,QAAI,GAAI,KAAI,IAAI,EAAE;AAAA,EACpB;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAKA,SAAS,sBAAsB,SAAmD;AAChF,QAAM,WAAW,QAAQ;AACzB,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,QAAQ,SAAU,QAAO,CAAC,OAAO,GAAG;AACtD,MAAI,MAAM,QAAQ,OAAO,GAAG,EAAG,QAAO,OAAO,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC7G,SAAO;AACT;AAEA,SAAS,iBAAiB,MAAc,UAAkB;AACxD,SAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AACjF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI;AACnB,QAAM,SAAS,YAAY,UAAU;AAAA,IACnC,MAAM,OAAO,IAAI,MAAM,KAAK;AAAA,IAC5B,UAAU,OAAO,IAAI,UAAU,KAAK;AAAA,IACpC,QAAQ,OAAO,IAAI,QAAQ,KAAK;AAAA,IAChC,QAAQ,eAAe,QAAQ,QAAQ,KAAK;AAAA,IAC5C,YAAY,eAAe,QAAQ,YAAY,KAAK;AAAA,IACpD,iBAAiB,OAAO,IAAI,iBAAiB,KAAK;AAAA,IAClD,aAAa,eAAe,QAAQ,aAAa,KAAK;AAAA,IACtD,UAAU,eAAe,QAAQ,UAAU,KAAK;AAAA,IAChD,WAAW,eAAe,QAAQ,WAAW,KAAK;AAAA,IAClD,eAAe,eAAe,QAAQ,eAAe,KAAK;AAAA,IAC1D,qBAAqB,OAAO,IAAI,qBAAqB,KAAK;AAAA,IAC1D,mBAAmB,OAAO,IAAI,mBAAmB,KAAK;AAAA,IACtD,SAAS,OAAO,IAAI,SAAS,KAAK;AAAA,IAClC,WAAW,OAAO,IAAI,WAAW,KAAK;AAAA,IACtC,WAAW,OAAO,IAAI,WAAW,KAAK;AAAA,IACtC,SAAS,OAAO,IAAI,SAAS,KAAK;AAAA,EACpC,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,QAAQ,OAAO;AAErB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,cAAc,UAAU,QAAqB,aAAa;AAEhE,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,oBAAoB,MAAM,YAAY,KAAK;AAOjD,QAAM,EAAE,gBAAgB,IAAI,+BAA+B,OAAO,IAAI;AACtE,QAAM,cAAc,oBAAoB,SACpC,OACA,MAAM,KAAK,IAAI,IAAI,gBAAgB,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC;AAC/F,MAAI,CAAC,mBAAmB;AACtB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,MAAI,aAAa,WAAW,GAAG;AAC7B,WAAO,iBAAiB,MAAM,MAAM,MAAM,QAAQ;AAAA,EACpD;AAIA,QAAM,iBAAiB,cAAc,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,IAAI,CAAC;AACjF,QAAM,gBAAgB,eAAe,YAAY,SAAS,IAAI,YAAY,CAAC,IAAI;AAM/E,QAAM,kBAAkB,EAAE,UAAU,mBAAmB,gBAAgB,cAAc;AAOrF,QAAM,uBAAuB,MAAM;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,EAAE,KAAK,KAAK;AAAA,MACtB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AAAA,IACA,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,IACrB;AAAA,EACF;AACA,QAAM,mBAAmB,cAAc,sBAAsB,QAAQ;AACrE,MAAI,iBAAiB,WAAW,GAAG;AACjC,WAAO,iBAAiB,MAAM,MAAM,MAAM,QAAQ;AAAA,EACpD;AAEA,QAAM,CAAC,wBAAwB,qBAAqB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxE;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,SAAS,EAAE,KAAK,iBAAiB,EAAE;AAAA,MACrC,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,MACnB;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,EAAE,KAAK,iBAAiB,EAAE;AAAA,MACpC,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,MACnB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,iBAAiB,MAAM;AAAA,IAC3B,oBAAI,IAAI;AAAA,MACN,GAAG,cAAc,wBAAwB,MAAM;AAAA,MAC/C,GAAG,cAAc,uBAAuB,MAAM;AAAA,IAChD,CAAC;AAAA,EACH;AACA,MAAI,eAAe,WAAW,GAAG;AAC/B,WAAO,iBAAiB,MAAM,MAAM,MAAM,QAAQ;AAAA,EACpD;AAEA,QAAM,MAAe;AAAA,IACnB;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,iBAAiB;AAAA,IACzC,iBAAiB;AAAA,IACjB,SAAS;AAAA,EACX;AAEA,QAAM,UAAU,MAAM,qBAAqB,OAAO,GAAG;AACrD,QAAM,oBAAoB,sBAAsB,OAAO;AAQvD,MAAI,kBAAkB;AACtB,MAAI,MAAM,UAAU,iBAAiB,SAAS,GAAG;AAC/C,UAAM,uBAAuB,MAAM,iDAAiD;AAAA,MAClF;AAAA,MACA,OAAO,MAAM;AAAA,MACb,SAAS;AAAA,QACP;AAAA,UACE,YAAY,EAAE,UAAU;AAAA,UACxB,QAAQ,CAAC,gBAAgB,iBAAiB,iBAAiB,aAAa;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,UAAM,2BAA2B,wBAAwB,CAAC,GAAG,OAAO,CAAC,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACpG,QAAI,wBAAwB,SAAS,GAAG;AACtC,YAAM,CAAC,qBAAqB,kBAAkB,IAAI,MAAM,QAAQ,IAAI;AAAA,QAClE;AAAA,UACE;AAAA,UACA;AAAA,UACA,EAAE,SAAS,EAAE,KAAK,wBAAwB,EAAE;AAAA,UAC5C,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,UACnB;AAAA,QACF;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,EAAE,QAAQ,EAAE,KAAK,wBAAwB,EAAE;AAAA,UAC3C,EAAE,QAAQ,CAAC,MAAM,EAAE;AAAA,UACnB;AAAA,QACF;AAAA,MACF,CAAC;AACD,UAAI,qBAAqB;AAAA,QACvB,GAAG,cAAc,qBAAqB,MAAM;AAAA,QAC5C,GAAG,cAAc,oBAAoB,MAAM;AAAA,MAC7C;AACA,UAAI,mBAAmB,SAAS,GAAG;AASjC,cAAM,qBAAqB;AAAA,UACzB,MAAM,qBAAqB,EAAE,GAAG,OAAO,QAAQ,OAAU,GAAG,GAAG;AAAA,QACjE;AACA,YAAI,oBAAoB;AACtB,gBAAM,kBAAkB,IAAI,IAAI,kBAAkB;AAClD,+BAAqB,mBAAmB,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,CAAC;AAAA,QAChF;AAAA,MACF;AACA,UAAI,mBAAmB,SAAS,GAAG;AACjC,0BAAkB,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAI,qBAAqB,CAAC,GAAI,GAAG,kBAAkB,CAAC,CAAC;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AAEA,QAAM,kBAAkB,kBAAkB,IAAI,IAAI,eAAe,IAAI;AACrE,QAAM,oBAAoB,kBACtB,eAAe,OAAO,CAAC,OAAO,gBAAgB,IAAI,EAAE,CAAC,IACrD;AAKJ,SAAQ,QAAoC;AAC5C,2BAAyB,SAAS,iBAAiB;AAEnD,QAAM,aAAa,MAAM,YAAY,aAAa,MAAM,SAAS,IAAI;AACrE,QAAM,UAAU,MAAM,YAAY,SAAS,QAAQ,OAAO,QAAQ;AAIlE,QAAM,OAAO,eAAe,OACxB,CAAC,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,IAC9B,CAAC,EAAE,OAAO,YAAY,KAAK,QAAQ,GAAG,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC;AAE3E,QAAM,MAAM,MAAM,YAAY,MAAM,EAAE,UAAU,eAAe;AAAA,IAC7D,QAAQ;AAAA,MACN;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,IACA,MAAM,EAAE,MAAM,MAAM,MAAM,UAAU,MAAM,SAAS;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,iBAAiB,eAAe;AAAA,EAClC,CAAC;AAED,QAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG;AAAA,IACvD,CAAC,QAAwC,CAAC,CAAC,OAAO,OAAO,QAAQ;AAAA,EACnE;AACA,QAAM,UAAU,KACb,IAAI,CAAC,QAAS,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK,IAAK,EACjF,OAAO,CAAC,UAA2B,UAAU,IAAI;AAIpD,QAAM,CAAC,cAAc,WAAW,IAAI,QAAQ,SACxC,MAAM,QAAQ,IAAI;AAAA,IAChB;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE;AAAA,MACzB,EAAE,UAAU,CAAC,SAAS,EAAE;AAAA,MACxB;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE;AAAA,MACzB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAAA,EACF,CAAC,IACD,CAAC,CAAC,GAAG,CAAC,CAAC;AAEX,QAAM,cAAc,aACjB,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,OAAO,CAAC,EAC7C,OAAO,CAAC,QAAwB,QAAQ,IAAI;AAC/C,QAAM,aAAa,YAChB,IAAI,CAAC,SAAS,YAAY,MAAM,KAAK,MAAM,CAAC,EAC5C,OAAO,CAAC,QAAwB,QAAQ,IAAI;AAC/C,QAAM,kBAAkB,kBAAkB,WAAW;AACrD,QAAM,eAAe,kBAAkB,UAAU;AAEjD,QAAM,kBAAkB,MAAM;AAAA,IAC5B,IAAI,IAAI,CAAC,GAAG,aAAa,GAAG,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAAA,EACpE;AACA,QAAM,YAAY,gBAAgB,SAC9B,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,QAAQ,EAAE,KAAK,gBAAgB;AAAA,MAC/B,UAAU,EAAE,KAAK,KAAK;AAAA,MACtB,WAAW,EAAE,KAAK,KAAK;AAAA,MACvB,UAAU;AAAA,MACV,GAAG;AAAA,IACL;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AAEL,QAAM,cAAgC,CAAC;AACvC,aAAW,WAAW,WAAW;AAC/B,UAAM,EAAE,IAAI,SAAS,IAAI,cAAc,QAAQ,MAAM;AACrD,QAAI,CAAC,SAAU;AACf,gBAAY,KAAK;AAAA,MACf,IAAI,QAAQ;AAAA,MACZ;AAAA,MACA,WAAW,QAAQ,cAAc;AAAA,MACjC,UAAU,QAAQ,YAAY;AAAA,MAC9B,WAAW,QAAQ,aAAa;AAAA,MAChC,MAAM,QAAQ,QAAQ;AAAA,MACtB,QAAQ,QAAQ,UAAU;AAAA,MAC1B,SAAS,QAAQ,WAAW;AAAA,MAC5B,WAAW,QAAQ,aAAa;AAAA,IAClC,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,CAAC,SAA+B;AAAA,IAC7C,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,WAAW,IAAI;AAAA,EACjB;AACA,QAAM,iBAAsD;AAAA,IAC1D;AAAA,IACA,YAAY,IAAI,MAAM;AAAA,IACtB,WAAW,IAAI,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,QAAQ,KACX,IAAI,CAAC,QAAQ;AACZ,UAAM,KAAK,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,IAAI,KAAK;AACzE,QAAI,CAAC,GAAI,QAAO;AAChB,WAAO;AAAA,MACL;AAAA,MACA,OAAO,eAAe,IAAI,KAAK;AAAA,MAC/B,QAAQ,eAAe,IAAI,MAAM;AAAA,MACjC,YAAY,eAAe,IAAI,WAAW;AAAA,MAC1C,iBAAiB,eAAe,IAAI,iBAAiB;AAAA,MACrD,eAAe,eAAe,IAAI,cAAc;AAAA,MAChD,aAAa,qBAAqB,IAAI,YAAY;AAAA,MAClD,eAAe,eAAe,IAAI,cAAc;AAAA,MAChD,aAAa,qBAAqB,IAAI,WAAW;AAAA,MACjD,iBAAiB,kBAAkB,IAAI,iBAAiB;AAAA,MACxD,aAAa,eAAe,IAAI,aAAa;AAAA,MAC7C,WAAW,kBAAkB,IAAI,UAAU;AAAA,MAC3C,WAAW,gBAAgB,IAAI,EAAE,KAAK,CAAC;AAAA,MACvC,QAAQ,aAAa,IAAI,EAAE,KAAK,CAAC;AAAA,MACjC,UAAU,eAAe,IAAI,EAAE,KAAK;AAAA,IACtC;AAAA,EACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAEnE,SAAO,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,OAAO,IAAI;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,IAAI,SAAS,MAAM,YAAY,EAAE;AAAA,IACvD,GAAI,IAAI,MAAM,sBAAsB,EAAE,eAAe,KAAK,IAAI,CAAC;AAAA,EACjE,CAAC;AACH;",
   "names": []
 }

package/dist/modules/customers/api/dictionaries/context.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -74,7 +75,7 @@ async function resolveDictionaryRouteContext(req, options) {
   });
   const em = container.resolve("em");
   const tenantId = scope?.tenantId ?? auth.tenantId;
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   const normalizeId = (value) => {
     if (typeof value !== "string") return null;
     const trimmed = value.trim();

package/dist/modules/customers/api/dictionaries/context.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customers/api/dictionaries/context.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer, type AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nexport const BUILTIN_DICTIONARY_ROUTE_KINDS = [\n  'statuses',\n  'sources',\n  'lifecycle-stages',\n  'address-types',\n  'activity-types',\n  'deal-statuses',\n  'pipeline-stages',\n  'job-titles',\n  'industries',\n  'temperature',\n  'renewal-quarters',\n  'person-company-roles',\n  'interaction-statuses',\n] as const\n\ntype BuiltinDictionaryRouteKind = (typeof BUILTIN_DICTIONARY_ROUTE_KINDS)[number]\n\nconst dictionaryCustomKindSchema = z\n  .string()\n  .trim()\n  .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid dictionary kind')\n\nexport const dictionaryKindSchema = z.union([\n  z.enum(BUILTIN_DICTIONARY_ROUTE_KINDS),\n  dictionaryCustomKindSchema,\n])\n\nexport type DictionaryRouteParam = z.infer<typeof dictionaryKindSchema>\nexport type DictionaryEntityKind = string\n\nconst KIND_MAP: Record<BuiltinDictionaryRouteKind, DictionaryEntityKind> = {\n  statuses: 'status',\n  sources: 'source',\n  'lifecycle-stages': 'lifecycle_stage',\n  'address-types': 'address_type',\n  'activity-types': 'activity_type',\n  'deal-statuses': 'deal_status',\n  'pipeline-stages': 'pipeline_stage',\n  'job-titles': 'job_title',\n  industries: 'industry',\n  temperature: 'temperature',\n  'renewal-quarters': 'renewal_quarter',\n  'person-company-roles': 'person_company_role',\n  'interaction-statuses': 'interaction_status',\n}\n\nexport const paramsSchema = z.object({\n  kind: dictionaryKindSchema,\n})\n\nexport type DictionaryRouteContext = {\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n  organizationId: string | null\n  tenantId: string\n  readableOrganizationIds: string[]\n  cache?: CacheStrategy\n  container: AppContainer\n  ctx: CommandRuntimeContext\n}\n\nexport function resolveDictionaryActorId(\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>,\n): string {\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport function mapDictionaryKind(kind: string | undefined) {\n  const parsed = paramsSchema.parse({ kind })\n  const mappedKind = Object.prototype.hasOwnProperty.call(KIND_MAP, parsed.kind)\n    ? KIND_MAP[parsed.kind as BuiltinDictionaryRouteKind]\n    : parsed.kind\n  return {\n    kind: parsed.kind,\n    mappedKind,\n  }\n}\n\nexport async function resolveDictionaryRouteContext(\n  req: Request,\n  options?: { selectedId?: string | null },\n): Promise<DictionaryRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    selectedId: options?.selectedId,\n  })\n  const em = (container.resolve('em') as EntityManager)\n  const tenantId = scope?.tenantId ?? auth.tenantId\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n  const normalizeId = (value: unknown): string | null => {\n    if (typeof value !== 'string') return null\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n\n  const candidateIds = new Set<string>()\n  const pushCandidate = (value: unknown) => {\n    const normalized = normalizeId(value)\n    if (normalized) candidateIds.add(normalized)\n  }\n\n  pushCandidate(organizationId)\n  pushCandidate(auth.orgId ?? null)\n  if (Array.isArray(scope?.filterIds)) {\n    for (const id of scope.filterIds) pushCandidate(id)\n  }\n  if (Array.isArray(scope?.allowedIds)) {\n    for (const id of scope.allowedIds) pushCandidate(id)\n  }\n\n  let cache: CacheStrategy | undefined\n  try {\n    cache = (container.resolve('cache') as CacheStrategy)\n  } catch {}\n\n  const readableOrganizationIds = new Set<string>()\n  try {\n    const shouldLoadAll = candidateIds.size === 0\n    const organizations = await em.find(\n      Organization,\n      {\n        tenant: tenantId as any,\n        deletedAt: null,\n        ...(shouldLoadAll ? {} : { id: { $in: Array.from(candidateIds) } }),\n      } as any,\n      { fields: ['id', 'ancestorIds'] },\n    )\n    for (const organization of organizations) {\n      const id = normalizeId(organization.id)\n      if (id) readableOrganizationIds.add(id)\n      if (Array.isArray(organization.ancestorIds)) {\n        for (const ancestorId of organization.ancestorIds) {\n          const normalized = normalizeId(ancestorId)\n          if (normalized) readableOrganizationIds.add(normalized)\n        }\n      }\n    }\n    if (!shouldLoadAll && readableOrganizationIds.size === 0) {\n      for (const id of candidateIds) readableOrganizationIds.add(id)\n    }\n  } catch (err) {\n    logger.warn('Failed to resolve ancestor organizations', { component: 'dictionaries.context', err })\n    for (const id of candidateIds) readableOrganizationIds.add(id)\n  }\n\n  const commandContext: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    auth,\n    translate,\n    em,\n    organizationId,\n    tenantId,\n    readableOrganizationIds: Array.from(readableOrganizationIds),\n    cache,\n    container,\n    ctx: commandContext,\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,8BAAiD;AAC1D,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAG9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,6BAA6B,EAChC,OAAO,EACP,KAAK,EACL,MAAM,8BAA8B,yBAAyB;AAEzD,MAAM,uBAAuB,EAAE,MAAM;AAAA,EAC1C,EAAE,KAAK,8BAA8B;AAAA,EACrC;AACF,CAAC;AAKD,MAAM,WAAqE;AAAA,EACzE,UAAU;AAAA,EACV,SAAS;AAAA,EACT,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,wBAAwB;AAC1B;AAEO,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,MAAM;AACR,CAAC;AAcM,SAAS,yBACd,MACQ;AACR,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEO,SAAS,kBAAkB,MAA0B;AAC1D,QAAM,SAAS,aAAa,MAAM,EAAE,KAAK,CAAC;AAC1C,QAAM,aAAa,OAAO,UAAU,eAAe,KAAK,UAAU,OAAO,IAAI,IACzE,SAAS,OAAO,IAAkC,IAClD,OAAO;AACX,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,EACF;AACF;AAEA,eAAsB,8BACpB,KACA,SACiC;AACjC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AAEA,QAAM,QAAQ,MAAM,mCAAmC;AAAA,IACrD;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,YAAY,SAAS;AAAA,EACvB,CAAC;AACD,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,WAAW,OAAO,YAAY,KAAK;AACzC,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAM,cAAc,CAAC,UAAkC;AACrD,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,gBAAgB,CAAC,UAAmB;AACxC,UAAM,aAAa,YAAY,KAAK;AACpC,QAAI,WAAY,cAAa,IAAI,UAAU;AAAA,EAC7C;AAEA,gBAAc,cAAc;AAC5B,gBAAc,KAAK,SAAS,IAAI;AAChC,MAAI,MAAM,QAAQ,OAAO,SAAS,GAAG;AACnC,eAAW,MAAM,MAAM,UAAW,eAAc,EAAE;AAAA,EACpD;AACA,MAAI,MAAM,QAAQ,OAAO,UAAU,GAAG;AACpC,eAAW,MAAM,MAAM,WAAY,eAAc,EAAE;AAAA,EACrD;AAEA,MAAI;AACJ,MAAI;AACF,YAAS,UAAU,QAAQ,OAAO;AAAA,EACpC,QAAQ;AAAA,EAAC;AAET,QAAM,0BAA0B,oBAAI,IAAY;AAChD,MAAI;AACF,UAAM,gBAAgB,aAAa,SAAS;AAC5C,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,GAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,YAAY,EAAE,EAAE;AAAA,MACnE;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,aAAa,EAAE;AAAA,IAClC;AACA,eAAW,gBAAgB,eAAe;AACxC,YAAM,KAAK,YAAY,aAAa,EAAE;AACtC,UAAI,GAAI,yBAAwB,IAAI,EAAE;AACtC,UAAI,MAAM,QAAQ,aAAa,WAAW,GAAG;AAC3C,mBAAW,cAAc,aAAa,aAAa;AACjD,gBAAM,aAAa,YAAY,UAAU;AACzC,cAAI,WAAY,yBAAwB,IAAI,UAAU;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,wBAAwB,SAAS,GAAG;AACxD,iBAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,IAC/D;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,4CAA4C,EAAE,WAAW,wBAAwB,IAAI,CAAC;AAClG,eAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,EAC/D;AAEA,QAAM,iBAAwC;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,MAAM,KAAK,uBAAuB;AAAA,IAC3D;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer, type AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nexport const BUILTIN_DICTIONARY_ROUTE_KINDS = [\n  'statuses',\n  'sources',\n  'lifecycle-stages',\n  'address-types',\n  'activity-types',\n  'deal-statuses',\n  'pipeline-stages',\n  'job-titles',\n  'industries',\n  'temperature',\n  'renewal-quarters',\n  'person-company-roles',\n  'interaction-statuses',\n] as const\n\ntype BuiltinDictionaryRouteKind = (typeof BUILTIN_DICTIONARY_ROUTE_KINDS)[number]\n\nconst dictionaryCustomKindSchema = z\n  .string()\n  .trim()\n  .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid dictionary kind')\n\nexport const dictionaryKindSchema = z.union([\n  z.enum(BUILTIN_DICTIONARY_ROUTE_KINDS),\n  dictionaryCustomKindSchema,\n])\n\nexport type DictionaryRouteParam = z.infer<typeof dictionaryKindSchema>\nexport type DictionaryEntityKind = string\n\nconst KIND_MAP: Record<BuiltinDictionaryRouteKind, DictionaryEntityKind> = {\n  statuses: 'status',\n  sources: 'source',\n  'lifecycle-stages': 'lifecycle_stage',\n  'address-types': 'address_type',\n  'activity-types': 'activity_type',\n  'deal-statuses': 'deal_status',\n  'pipeline-stages': 'pipeline_stage',\n  'job-titles': 'job_title',\n  industries: 'industry',\n  temperature: 'temperature',\n  'renewal-quarters': 'renewal_quarter',\n  'person-company-roles': 'person_company_role',\n  'interaction-statuses': 'interaction_status',\n}\n\nexport const paramsSchema = z.object({\n  kind: dictionaryKindSchema,\n})\n\nexport type DictionaryRouteContext = {\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n  organizationId: string | null\n  tenantId: string\n  readableOrganizationIds: string[]\n  cache?: CacheStrategy\n  container: AppContainer\n  ctx: CommandRuntimeContext\n}\n\nexport function resolveDictionaryActorId(\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>,\n): string {\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport function mapDictionaryKind(kind: string | undefined) {\n  const parsed = paramsSchema.parse({ kind })\n  const mappedKind = Object.prototype.hasOwnProperty.call(KIND_MAP, parsed.kind)\n    ? KIND_MAP[parsed.kind as BuiltinDictionaryRouteKind]\n    : parsed.kind\n  return {\n    kind: parsed.kind,\n    mappedKind,\n  }\n}\n\nexport async function resolveDictionaryRouteContext(\n  req: Request,\n  options?: { selectedId?: string | null },\n): Promise<DictionaryRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({\n    container,\n    auth,\n    request: req,\n    selectedId: options?.selectedId,\n  })\n  const em = (container.resolve('em') as EntityManager)\n  const tenantId = scope?.tenantId ?? auth.tenantId\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n  const normalizeId = (value: unknown): string | null => {\n    if (typeof value !== 'string') return null\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n\n  const candidateIds = new Set<string>()\n  const pushCandidate = (value: unknown) => {\n    const normalized = normalizeId(value)\n    if (normalized) candidateIds.add(normalized)\n  }\n\n  pushCandidate(organizationId)\n  pushCandidate(auth.orgId ?? null)\n  if (Array.isArray(scope?.filterIds)) {\n    for (const id of scope.filterIds) pushCandidate(id)\n  }\n  if (Array.isArray(scope?.allowedIds)) {\n    for (const id of scope.allowedIds) pushCandidate(id)\n  }\n\n  let cache: CacheStrategy | undefined\n  try {\n    cache = (container.resolve('cache') as CacheStrategy)\n  } catch {}\n\n  const readableOrganizationIds = new Set<string>()\n  try {\n    const shouldLoadAll = candidateIds.size === 0\n    const organizations = await em.find(\n      Organization,\n      {\n        tenant: tenantId as any,\n        deletedAt: null,\n        ...(shouldLoadAll ? {} : { id: { $in: Array.from(candidateIds) } }),\n      } as any,\n      { fields: ['id', 'ancestorIds'] },\n    )\n    for (const organization of organizations) {\n      const id = normalizeId(organization.id)\n      if (id) readableOrganizationIds.add(id)\n      if (Array.isArray(organization.ancestorIds)) {\n        for (const ancestorId of organization.ancestorIds) {\n          const normalized = normalizeId(ancestorId)\n          if (normalized) readableOrganizationIds.add(normalized)\n        }\n      }\n    }\n    if (!shouldLoadAll && readableOrganizationIds.size === 0) {\n      for (const id of candidateIds) readableOrganizationIds.add(id)\n    }\n  } catch (err) {\n    logger.warn('Failed to resolve ancestor organizations', { component: 'dictionaries.context', err })\n    for (const id of candidateIds) readableOrganizationIds.add(id)\n  }\n\n  const commandContext: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    auth,\n    translate,\n    em,\n    organizationId,\n    tenantId,\n    readableOrganizationIds: Array.from(readableOrganizationIds),\n    cache,\n    container,\n    ctx: commandContext,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,8BAAiD;AAC1D,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAG9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEhC,MAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,6BAA6B,EAChC,OAAO,EACP,KAAK,EACL,MAAM,8BAA8B,yBAAyB;AAEzD,MAAM,uBAAuB,EAAE,MAAM;AAAA,EAC1C,EAAE,KAAK,8BAA8B;AAAA,EACrC;AACF,CAAC;AAKD,MAAM,WAAqE;AAAA,EACzE,UAAU;AAAA,EACV,SAAS;AAAA,EACT,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,wBAAwB;AAC1B;AAEO,MAAM,eAAe,EAAE,OAAO;AAAA,EACnC,MAAM;AACR,CAAC;AAcM,SAAS,yBACd,MACQ;AACR,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEO,SAAS,kBAAkB,MAA0B;AAC1D,QAAM,SAAS,aAAa,MAAM,EAAE,KAAK,CAAC;AAC1C,QAAM,aAAa,OAAO,UAAU,eAAe,KAAK,UAAU,OAAO,IAAI,IACzE,SAAS,OAAO,IAAkC,IAClD,OAAO;AACX,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,EACF;AACF;AAEA,eAAsB,8BACpB,KACA,SACiC;AACjC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AAEA,QAAM,QAAQ,MAAM,mCAAmC;AAAA,IACrD;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,YAAY,SAAS;AAAA,EACvB,CAAC;AACD,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,WAAW,OAAO,YAAY,KAAK;AACzC,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAM,cAAc,CAAC,UAAkC;AACrD,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,gBAAgB,CAAC,UAAmB;AACxC,UAAM,aAAa,YAAY,KAAK;AACpC,QAAI,WAAY,cAAa,IAAI,UAAU;AAAA,EAC7C;AAEA,gBAAc,cAAc;AAC5B,gBAAc,KAAK,SAAS,IAAI;AAChC,MAAI,MAAM,QAAQ,OAAO,SAAS,GAAG;AACnC,eAAW,MAAM,MAAM,UAAW,eAAc,EAAE;AAAA,EACpD;AACA,MAAI,MAAM,QAAQ,OAAO,UAAU,GAAG;AACpC,eAAW,MAAM,MAAM,WAAY,eAAc,EAAE;AAAA,EACrD;AAEA,MAAI;AACJ,MAAI;AACF,YAAS,UAAU,QAAQ,OAAO;AAAA,EACpC,QAAQ;AAAA,EAAC;AAET,QAAM,0BAA0B,oBAAI,IAAY;AAChD,MAAI;AACF,UAAM,gBAAgB,aAAa,SAAS;AAC5C,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,GAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,YAAY,EAAE,EAAE;AAAA,MACnE;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,aAAa,EAAE;AAAA,IAClC;AACA,eAAW,gBAAgB,eAAe;AACxC,YAAM,KAAK,YAAY,aAAa,EAAE;AACtC,UAAI,GAAI,yBAAwB,IAAI,EAAE;AACtC,UAAI,MAAM,QAAQ,aAAa,WAAW,GAAG;AAC3C,mBAAW,cAAc,aAAa,aAAa;AACjD,gBAAM,aAAa,YAAY,UAAU;AACzC,cAAI,WAAY,yBAAwB,IAAI,UAAU;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,wBAAwB,SAAS,GAAG;AACxD,iBAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,IAC/D;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,4CAA4C,EAAE,WAAW,wBAAwB,IAAI,CAAC;AAClG,eAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,EAC/D;AAEA,QAAM,iBAAwC;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,MAAM,KAAK,uBAAuB;AAAA,IAC3D;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/customers/api/entity-roles-factory.js

@@ -6,6 +6,7 @@ import { CrudHttpError, isCrudHttpError, notFound } from "@open-mercato/shared/l
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { CustomerEntity, CustomerEntityRole } from "../data/entities.js";
 import { entityRoleCreateSchema, entityRoleUpdateSchema, entityRoleDeleteSchema } from "../data/validators.js";
@@ -91,7 +92,7 @@ async function resolveEntityRouteScope(em, auth, scope, entityType, entityId, tr
     CustomerEntity,
     { id: entityId, kind: entityType, tenantId: auth.tenantId, deletedAt: null },
     void 0,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null }
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null }
   );
   if (!entity || entity.tenantId !== auth.tenantId) {
     throw notFound(translate("customers.errors.customer_not_found", "Customer not found"));
@@ -109,7 +110,7 @@ async function resolveRoleRouteScope(em, auth, scope, entityType, entityId, role
     CustomerEntityRole,
     { id: roleId, tenantId: auth.tenantId, entityType, entityId, deletedAt: null },
     void 0,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null }
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null }
   );
   if (!role || role.tenantId !== auth.tenantId || role.entityType !== entityType || role.entityId !== entityId) {
     throw notFound(translate("customers.errors.role_not_found", "Role not found"));

package/dist/modules/customers/api/entity-roles-factory.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/api/entity-roles-factory.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerEntity, CustomerEntityRole } from '../data/entities'\nimport { entityRoleCreateSchema, entityRoleUpdateSchema, entityRoleDeleteSchema, type EntityRoleCreateInput, type EntityRoleUpdateInput, type EntityRoleDeleteInput } from '../data/validators'\nimport { withScopedPayload } from './utils'\nimport { resolveCustomersRequestContext, resolveAuthActorId } from '../lib/interactionRequestContext'\nimport { deriveDisplayNameFromEmail } from '../lib/displayName'\nimport { withOperationMetadata } from '../lib/operationMetadata'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\nconst roleIdQuerySchema = z.object({ roleId: z.string().uuid() })\n\nconst createBodySchema = z.object({\n  roleType: z.string().trim().min(1).max(100),\n  userId: z.string().uuid(),\n})\nconst updateBodySchema = z.object({\n  userId: z.string().uuid(),\n})\n\nconst listItemSchema = z.object({\n  id: z.string().uuid(),\n  entityType: z.enum(['company', 'person']),\n  entityId: z.string().uuid(),\n  userId: z.string().uuid(),\n  userName: z.string().nullable().optional(),\n  userEmail: z.string().nullable().optional(),\n  userPhone: z.string().nullable().optional(),\n  roleType: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst listResponseSchema = z.object({ items: z.array(listItemSchema) })\nconst okResponseSchema = z.object({ ok: z.boolean() })\nconst createResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\ntype EntityType = 'company' | 'person'\n\ntype Translator = Awaited<ReturnType<typeof resolveTranslations>>['translate']\n\nfunction getRoleContext(entityType: EntityType, entityId: string) {\n  const resourceKind = entityType === 'company' ? 'customers.company' : 'customers.person'\n  return { entityType, entityId, resourceKind, resourceId: entityId }\n}\n\nfunction buildValidationErrorResponse(error: z.ZodError, translate: Translator) {\n  return NextResponse.json(\n    { error: translate('customers.errors.validationFailed', 'Validation failed'), fieldErrors: error.flatten().fieldErrors },\n    { status: 400 },\n  )\n}\n\nasync function buildContext(request: Request) {\n  const context = await resolveCustomersRequestContext(request)\n  return {\n    ...context,\n    ctx: context.commandContext,\n  }\n}\n\nfunction ensureRouteOrganizationAccess(\n  organizationId: string,\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  notFoundMessage: string,\n) {\n  // Existence oracle (#5504): a caller who holds the feature but whose scope\n  // excludes the record's organization is denied as not-found (the same response\n  // the caller gets for a missing record), so this cannot reveal that the record\n  // exists in an organization they cannot see.\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    throw notFound(notFoundMessage)\n  }\n}\n\nasync function ensureFeatureOnOrganization(\n  container: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['container'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  feature: string,\n  organizationId: string,\n  translate: Translator,\n) {\n  const actorId = resolveAuthActorId(auth)\n  if (!actorId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n  let rbac: RbacService | undefined\n  try {\n    rbac = container.resolve('rbacService') as RbacService | undefined\n  } catch (err) {\n    logger.error('rbacService resolve failed', { component: 'entity-roles-factory', err })\n    rbac = undefined\n  }\n  if (!rbac) {\n    throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n  }\n  const hasFeature = await rbac.userHasAllFeatures(actorId, [feature], {\n    tenantId: auth.tenantId,\n    organizationId,\n  })\n  if (!hasFeature) {\n    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n  }\n}\n\nasync function resolveEntityRouteScope(\n  em: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['em'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  entityType: EntityType,\n  entityId: string,\n  translate: Translator,\n) {\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    { id: entityId, kind: entityType, tenantId: auth.tenantId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null },\n  )\n  if (!entity || entity.tenantId !== auth.tenantId) {\n    throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))\n  }\n  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate('customers.errors.customer_not_found', 'Customer not found'))\n  return {\n    entity,\n    organizationId: entity.organizationId,\n    tenantId: entity.tenantId,\n  }\n}\n\nasync function resolveRoleRouteScope(\n  em: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['em'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  entityType: EntityType,\n  entityId: string,\n  roleId: string,\n  translate: Translator,\n) {\n  const role = await findOneWithDecryption(\n    em,\n    CustomerEntityRole,\n    { id: roleId, tenantId: auth.tenantId, entityType, entityId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null },\n  )\n  if (\n    !role ||\n    role.tenantId !== auth.tenantId ||\n    role.entityType !== entityType ||\n    role.entityId !== entityId\n  ) {\n    throw notFound(translate('customers.errors.role_not_found', 'Role not found'))\n  }\n  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate('customers.errors.role_not_found', 'Role not found'))\n  return {\n    role,\n    organizationId: role.organizationId,\n    tenantId: role.tenantId,\n  }\n}\n\nfunction createScopedCommandContext(\n  ctx: Awaited<ReturnType<typeof buildContext>>['ctx'],\n  organizationId: string,\n) {\n  return {\n    ...ctx,\n    selectedOrganizationId: organizationId,\n    organizationIds: [organizationId],\n  }\n}\n\nexport const entityRolesMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.roles.view'] },\n  POST: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n}\n\nexport function buildEntityRolesOpenApi(entityType: EntityType): OpenApiRouteDoc {\n  const label = entityType === 'company' ? 'company' : 'person'\n  return {\n    tag: 'Customers',\n    summary: `${label.charAt(0).toUpperCase() + label.slice(1)} role assignments`,\n    pathParams: paramsSchema,\n    methods: {\n      GET: {\n        summary: `List roles for a ${label}`,\n        responses: [{ status: 200, description: 'Role assignments', schema: listResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n        ],\n      },\n      POST: {\n        summary: `Assign a role to a ${label}`,\n        requestBody: { contentType: 'application/json', schema: createBodySchema },\n        responses: [{ status: 201, description: 'Role created', schema: createResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 409, description: 'Role already assigned', schema: errorSchema },\n        ],\n      },\n      PUT: {\n        summary: `Update a ${label} role assignment`,\n        query: roleIdQuerySchema,\n        requestBody: { contentType: 'application/json', schema: updateBodySchema },\n        responses: [{ status: 200, description: 'Role updated', schema: okResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 404, description: 'Role not found', schema: errorSchema },\n        ],\n      },\n      DELETE: {\n        summary: `Remove a ${label} role assignment`,\n        query: roleIdQuerySchema,\n        responses: [{ status: 200, description: 'Role deleted', schema: okResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 404, description: 'Role not found', schema: errorSchema },\n        ],\n      },\n    },\n  }\n}\n\nexport function createEntityRolesHandlers(entityType: EntityType) {\n  const resourceKind = entityType === 'company' ? 'customers.company' : 'customers.person'\n  const logPrefix = entityType === 'company' ? 'customers.company.roles' : 'customers.person.roles'\n\n  async function GET(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { container, em, auth, scope } = await buildContext(request)\n      const targetScope = await resolveEntityRouteScope(em, auth, scope, entityType, entityId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.view', targetScope.organizationId, translate)\n\n      const roles = await findWithDecryption(\n        em,\n        CustomerEntityRole,\n        {\n          entityType,\n          entityId,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n          deletedAt: null,\n        },\n        { orderBy: { roleType: 'asc' } },\n        {\n          tenantId: targetScope.tenantId,\n          organizationId: targetScope.organizationId,\n        },\n      )\n\n      const userIds = Array.from(new Set(roles.map((role) => role.userId).filter((value): value is string => typeof value === 'string' && value.length > 0)))\n      const users = userIds.length\n        ? await findWithDecryption(\n            em,\n            User,\n            {\n              id: { $in: userIds },\n              deletedAt: null,\n              ...(targetScope.tenantId ? { tenantId: targetScope.tenantId } : {}),\n            },\n            undefined,\n            {\n              tenantId: targetScope.tenantId,\n              organizationId: targetScope.organizationId,\n            },\n          )\n        : []\n      const userMap = new Map(users.map((user) => [user.id, {\n        name: user.name ?? deriveDisplayNameFromEmail(user.email) ?? null,\n        email: user.email ?? null,\n        phone: null,\n      }]))\n\n      return NextResponse.json({\n        items: roles.map((role) => ({\n          ...(userMap.has(role.userId)\n            ? {\n                userName: userMap.get(role.userId)?.name ?? null,\n                userEmail: userMap.get(role.userId)?.email ?? null,\n                userPhone: userMap.get(role.userId)?.phone ?? null,\n              }\n            : {}),\n          id: role.id,\n          entityType: role.entityType,\n          entityId: role.entityId,\n          userId: role.userId,\n          roleType: role.roleType,\n          createdAt: role.createdAt.toISOString(),\n          updatedAt: role.updatedAt.toISOString(),\n        })),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles GET failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_load_roles', 'Failed to load roles') }, { status: 500 })\n    }\n  }\n\n  async function POST(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveEntityRouteScope(em, auth, scope, entityType, entityId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const rawBody = await readJsonSafe<Record<string, unknown>>(request, {})\n      const scoped = withScopedPayload(\n        {\n          ...rawBody,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n          ...getRoleContext(entityType, entityId),\n        },\n        commandCtx,\n        translate,\n      )\n      const parsed = entityRoleCreateSchema.parse(scoped)\n\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: rawBody,\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { result, logEntry } = await commandBus.execute<EntityRoleCreateInput, { roleId: string }>(\n        'customers.entityRoles.create',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ id: result?.roleId ?? null }, { status: 201 }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles POST failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_assign_role', 'Failed to assign role') }, { status: 500 })\n    }\n  }\n\n  async function PUT(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { roleId } = roleIdQuerySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveRoleRouteScope(em, auth, scope, entityType, entityId, roleId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const rawBody = await readJsonSafe<Record<string, unknown>>(request, {})\n      const scoped = withScopedPayload(\n        {\n          ...rawBody,\n          id: roleId,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n        },\n        commandCtx,\n        translate,\n      )\n      const parsed = entityRoleUpdateSchema.parse(scoped)\n\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: { roleId, ...rawBody },\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { logEntry } = await commandBus.execute<EntityRoleUpdateInput, { roleId: string }>(\n        'customers.entityRoles.update',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ ok: true }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles PUT failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_update_role', 'Failed to update role') }, { status: 500 })\n    }\n  }\n\n  async function DELETE(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { roleId } = roleIdQuerySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveRoleRouteScope(em, auth, scope, entityType, entityId, roleId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const parsed = entityRoleDeleteSchema.parse(\n        withScopedPayload(\n          {\n            id: roleId,\n            organizationId: targetScope.organizationId,\n            tenantId: targetScope.tenantId,\n          },\n          commandCtx,\n          translate,\n        ),\n      )\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: { roleId },\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { logEntry } = await commandBus.execute<EntityRoleDeleteInput, { roleId: string }>(\n        'customers.entityRoles.delete',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ ok: true }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles DELETE failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_delete_role', 'Failed to delete role') }, { status: 500 })\n    }\n  }\n\n  return { GET, POST, PUT, DELETE }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD,SAAS,YAAY;AAErB,SAAS,gBAAgB,0BAA0B;AACnD,SAAS,wBAAwB,wBAAwB,8BAAkH;AAC3K,SAAS,yBAAyB;AAClC,SAAS,gCAAgC,0BAA0B;AACnE,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvD,MAAM,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhE,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,EAAE,CAAC;AACtE,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrD,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAMlD,SAAS,eAAe,YAAwB,UAAkB;AAChE,QAAM,eAAe,eAAe,YAAY,sBAAsB;AACtE,SAAO,EAAE,YAAY,UAAU,cAAc,YAAY,SAAS;AACpE;AAEA,SAAS,6BAA6B,OAAmB,WAAuB;AAC9E,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,UAAU,qCAAqC,mBAAmB,GAAG,aAAa,MAAM,QAAQ,EAAE,YAAY;AAAA,IACvH,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,aAAa,SAAkB;AAC5C,QAAM,UAAU,MAAM,+BAA+B,OAAO;AAC5D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,QAAQ;AAAA,EACf;AACF;AAEA,SAAS,8BACP,gBACA,OACA,MACA,iBACA;AAKA,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,UAAM,SAAS,eAAe;AAAA,EAChC;AACF;AAEA,eAAe,4BACb,WACA,MACA,SACA,gBACA,WACA;AACA,QAAM,UAAU,mBAAmB,IAAI;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AACA,MAAI;AACJ,MAAI;AACF,WAAO,UAAU,QAAQ,aAAa;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,MAAM,8BAA8B,EAAE,WAAW,wBAAwB,IAAI,CAAC;AACrF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,EAClG;AACA,QAAM,aAAa,MAAM,KAAK,mBAAmB,SAAS,CAAC,OAAO,GAAG;AAAA,IACnE,UAAU,KAAK;AAAA,IACf;AAAA,EACF,CAAC;AACD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,EACtG;AACF;AAEA,eAAe,wBACb,IACA,MACA,OACA,YACA,UACA,WACA;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,YAAY,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC3E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,OAAO,cAAc,KAAK,SAAS,KAAK;AAAA,EACrF;AACA,MAAI,CAAC,UAAU,OAAO,aAAa,KAAK,UAAU;AAChD,UAAM,SAAS,UAAU,uCAAuC,oBAAoB,CAAC;AAAA,EACvF;AACA,gCAA8B,OAAO,gBAAgB,OAAO,MAAM,UAAU,uCAAuC,oBAAoB,CAAC;AACxI,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAe,sBACb,IACA,MACA,OACA,YACA,UACA,QACA,WACA;AACA,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,UAAU,KAAK,UAAU,YAAY,UAAU,WAAW,KAAK;AAAA,IAC7E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,OAAO,cAAc,KAAK,SAAS,KAAK;AAAA,EACrF;AACA,MACE,CAAC,QACD,KAAK,aAAa,KAAK,YACvB,KAAK,eAAe,cACpB,KAAK,aAAa,UAClB;AACA,UAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,EAC/E;AACA,gCAA8B,KAAK,gBAAgB,OAAO,MAAM,UAAU,mCAAmC,gBAAgB,CAAC;AAC9H,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB;AACF;AAEA,SAAS,2BACP,KACA,gBACA;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,wBAAwB;AAAA,IACxB,iBAAiB,CAAC,cAAc;AAAA,EAClC;AACF;AAEO,MAAM,sBAAsB;AAAA,EACjC,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACvE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAC3E;AAEO,SAAS,wBAAwB,YAAyC;AAC/E,QAAM,QAAQ,eAAe,YAAY,YAAY;AACrD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,SAAS,GAAG,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC;AAAA,IAC1D,YAAY;AAAA,IACZ,SAAS;AAAA,MACP,KAAK;AAAA,QACH,SAAS,oBAAoB,KAAK;AAAA,QAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB,CAAC;AAAA,QACxF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAClE;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,SAAS,sBAAsB,KAAK;AAAA,QACpC,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,QACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,qBAAqB,CAAC;AAAA,QACtF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QAC3E;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,SAAS,YAAY,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,QACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB,CAAC;AAAA,QAClF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QACpE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,SAAS,YAAY,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB,CAAC;AAAA,QAClF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,YAAwB;AAChE,QAAM,eAAe,eAAe,YAAY,sBAAsB;AACtE,QAAM,YAAY,eAAe,YAAY,4BAA4B;AAEzE,iBAAe,IAAI,SAAkB,EAAE,OAAO,GAA+B;AAC3E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,WAAW,IAAI,MAAM,MAAM,IAAI,MAAM,aAAa,OAAO;AACjE,YAAM,cAAc,MAAM,wBAAwB,IAAI,MAAM,OAAO,YAAY,UAAU,SAAS;AAClG,YAAM,4BAA4B,WAAW,MAAM,wBAAwB,YAAY,gBAAgB,SAAS;AAEhH,YAAM,QAAQ,MAAM;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,UACtB,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,QAC/B;AAAA,UACE,UAAU,YAAY;AAAA,UACtB,gBAAgB,YAAY;AAAA,QAC9B;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC,CAAC;AACtJ,YAAM,QAAQ,QAAQ,SAClB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,GAAI,YAAY,WAAW,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;AAAA,QACnE;AAAA,QACA;AAAA,QACA;AAAA,UACE,UAAU,YAAY;AAAA,UACtB,gBAAgB,YAAY;AAAA,QAC9B;AAAA,MACF,IACA,CAAC;AACL,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;AAAA,QACpD,MAAM,KAAK,QAAQ,2BAA2B,KAAK,KAAK,KAAK;AAAA,QAC7D,OAAO,KAAK,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC,CAAC,CAAC;AAEH,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,GAAI,QAAQ,IAAI,KAAK,MAAM,IACvB;AAAA,YACE,UAAU,QAAQ,IAAI,KAAK,MAAM,GAAG,QAAQ;AAAA,YAC5C,WAAW,QAAQ,IAAI,KAAK,MAAM,GAAG,SAAS;AAAA,YAC9C,WAAW,QAAQ,IAAI,KAAK,MAAM,GAAG,SAAS;AAAA,UAChD,IACA,CAAC;AAAA,UACL,IAAI,KAAK;AAAA,UACT,YAAY,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,QAAQ,KAAK;AAAA,UACb,UAAU,KAAK;AAAA,UACf,WAAW,KAAK,UAAU,YAAY;AAAA,UACtC,WAAW,KAAK,UAAU,YAAY;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,2BAA2B,EAAE,WAAW,WAAW,IAAI,CAAC;AACrE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yCAAyC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjI;AAAA,EACF;AAEA,iBAAe,KAAK,SAAkB,EAAE,OAAO,GAA+B;AAC5E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,wBAAwB,IAAI,MAAM,OAAO,YAAY,UAAU,SAAS;AAClG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,UAAU,MAAM,aAAsC,SAAS,CAAC,CAAC;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,UACE,GAAG;AAAA,UACH,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,UACtB,GAAG,eAAe,YAAY,QAAQ;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,MAAM,MAAM;AAElD,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB;AAAA,MACnF,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,QAC5C;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,QAAQ,UAAU,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjE;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,4BAA4B,EAAE,WAAW,WAAW,IAAI,CAAC;AACtE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,iBAAe,IAAI,SAAkB,EAAE,OAAO,GAA+B;AAC3E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,OAAO,IAAI,kBAAkB,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AAChG,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,OAAO,YAAY,UAAU,QAAQ,SAAS;AACxG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,UAAU,MAAM,aAAsC,SAAS,CAAC,CAAC;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,UACE,GAAG;AAAA,UACH,IAAI;AAAA,UACJ,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,MAAM,MAAM;AAElD,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB,EAAE,QAAQ,GAAG,QAAQ;AAAA,MACxG,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,QACpC;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,QAC9B;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,2BAA2B,EAAE,WAAW,WAAW,IAAI,CAAC;AACrE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,EAAE,OAAO,GAA+B;AAC9E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,OAAO,IAAI,kBAAkB,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AAChG,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,OAAO,YAAY,UAAU,QAAQ,SAAS;AACxG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,SAAS,uBAAuB;AAAA,QACpC;AAAA,UACE;AAAA,YACE,IAAI;AAAA,YACJ,gBAAgB,YAAY;AAAA,YAC5B,UAAU,YAAY;AAAA,UACxB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB,EAAE,OAAO;AAAA,MAC5F,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,QACpC;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,QAC9B;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,8BAA8B,EAAE,WAAW,WAAW,IAAI,CAAC;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,MAAM,KAAK,OAAO;AAClC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerEntity, CustomerEntityRole } from '../data/entities'\nimport { entityRoleCreateSchema, entityRoleUpdateSchema, entityRoleDeleteSchema, type EntityRoleCreateInput, type EntityRoleUpdateInput, type EntityRoleDeleteInput } from '../data/validators'\nimport { withScopedPayload } from './utils'\nimport { resolveCustomersRequestContext, resolveAuthActorId } from '../lib/interactionRequestContext'\nimport { deriveDisplayNameFromEmail } from '../lib/displayName'\nimport { withOperationMetadata } from '../lib/operationMetadata'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\nconst roleIdQuerySchema = z.object({ roleId: z.string().uuid() })\n\nconst createBodySchema = z.object({\n  roleType: z.string().trim().min(1).max(100),\n  userId: z.string().uuid(),\n})\nconst updateBodySchema = z.object({\n  userId: z.string().uuid(),\n})\n\nconst listItemSchema = z.object({\n  id: z.string().uuid(),\n  entityType: z.enum(['company', 'person']),\n  entityId: z.string().uuid(),\n  userId: z.string().uuid(),\n  userName: z.string().nullable().optional(),\n  userEmail: z.string().nullable().optional(),\n  userPhone: z.string().nullable().optional(),\n  roleType: z.string(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst listResponseSchema = z.object({ items: z.array(listItemSchema) })\nconst okResponseSchema = z.object({ ok: z.boolean() })\nconst createResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\ntype EntityType = 'company' | 'person'\n\ntype Translator = Awaited<ReturnType<typeof resolveTranslations>>['translate']\n\nfunction getRoleContext(entityType: EntityType, entityId: string) {\n  const resourceKind = entityType === 'company' ? 'customers.company' : 'customers.person'\n  return { entityType, entityId, resourceKind, resourceId: entityId }\n}\n\nfunction buildValidationErrorResponse(error: z.ZodError, translate: Translator) {\n  return NextResponse.json(\n    { error: translate('customers.errors.validationFailed', 'Validation failed'), fieldErrors: error.flatten().fieldErrors },\n    { status: 400 },\n  )\n}\n\nasync function buildContext(request: Request) {\n  const context = await resolveCustomersRequestContext(request)\n  return {\n    ...context,\n    ctx: context.commandContext,\n  }\n}\n\nfunction ensureRouteOrganizationAccess(\n  organizationId: string,\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  notFoundMessage: string,\n) {\n  // Existence oracle (#5504): a caller who holds the feature but whose scope\n  // excludes the record's organization is denied as not-found (the same response\n  // the caller gets for a missing record), so this cannot reveal that the record\n  // exists in an organization they cannot see.\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    throw notFound(notFoundMessage)\n  }\n}\n\nasync function ensureFeatureOnOrganization(\n  container: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['container'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  feature: string,\n  organizationId: string,\n  translate: Translator,\n) {\n  const actorId = resolveAuthActorId(auth)\n  if (!actorId) {\n    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })\n  }\n  let rbac: RbacService | undefined\n  try {\n    rbac = container.resolve('rbacService') as RbacService | undefined\n  } catch (err) {\n    logger.error('rbacService resolve failed', { component: 'entity-roles-factory', err })\n    rbac = undefined\n  }\n  if (!rbac) {\n    throw new CrudHttpError(500, { error: translate('customers.errors.internal', 'Internal error') })\n  }\n  const hasFeature = await rbac.userHasAllFeatures(actorId, [feature], {\n    tenantId: auth.tenantId,\n    organizationId,\n  })\n  if (!hasFeature) {\n    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })\n  }\n}\n\nasync function resolveEntityRouteScope(\n  em: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['em'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  entityType: EntityType,\n  entityId: string,\n  translate: Translator,\n) {\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    { id: entityId, kind: entityType, tenantId: auth.tenantId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (!entity || entity.tenantId !== auth.tenantId) {\n    throw notFound(translate('customers.errors.customer_not_found', 'Customer not found'))\n  }\n  ensureRouteOrganizationAccess(entity.organizationId, scope, auth, translate('customers.errors.customer_not_found', 'Customer not found'))\n  return {\n    entity,\n    organizationId: entity.organizationId,\n    tenantId: entity.tenantId,\n  }\n}\n\nasync function resolveRoleRouteScope(\n  em: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['em'],\n  auth: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['auth'],\n  scope: Awaited<ReturnType<typeof resolveCustomersRequestContext>>['scope'],\n  entityType: EntityType,\n  entityId: string,\n  roleId: string,\n  translate: Translator,\n) {\n  const role = await findOneWithDecryption(\n    em,\n    CustomerEntityRole,\n    { id: roleId, tenantId: auth.tenantId, entityType, entityId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (\n    !role ||\n    role.tenantId !== auth.tenantId ||\n    role.entityType !== entityType ||\n    role.entityId !== entityId\n  ) {\n    throw notFound(translate('customers.errors.role_not_found', 'Role not found'))\n  }\n  ensureRouteOrganizationAccess(role.organizationId, scope, auth, translate('customers.errors.role_not_found', 'Role not found'))\n  return {\n    role,\n    organizationId: role.organizationId,\n    tenantId: role.tenantId,\n  }\n}\n\nfunction createScopedCommandContext(\n  ctx: Awaited<ReturnType<typeof buildContext>>['ctx'],\n  organizationId: string,\n) {\n  return {\n    ...ctx,\n    selectedOrganizationId: organizationId,\n    organizationIds: [organizationId],\n  }\n}\n\nexport const entityRolesMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.roles.view'] },\n  POST: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.roles.manage'] },\n}\n\nexport function buildEntityRolesOpenApi(entityType: EntityType): OpenApiRouteDoc {\n  const label = entityType === 'company' ? 'company' : 'person'\n  return {\n    tag: 'Customers',\n    summary: `${label.charAt(0).toUpperCase() + label.slice(1)} role assignments`,\n    pathParams: paramsSchema,\n    methods: {\n      GET: {\n        summary: `List roles for a ${label}`,\n        responses: [{ status: 200, description: 'Role assignments', schema: listResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n        ],\n      },\n      POST: {\n        summary: `Assign a role to a ${label}`,\n        requestBody: { contentType: 'application/json', schema: createBodySchema },\n        responses: [{ status: 201, description: 'Role created', schema: createResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 409, description: 'Role already assigned', schema: errorSchema },\n        ],\n      },\n      PUT: {\n        summary: `Update a ${label} role assignment`,\n        query: roleIdQuerySchema,\n        requestBody: { contentType: 'application/json', schema: updateBodySchema },\n        responses: [{ status: 200, description: 'Role updated', schema: okResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 404, description: 'Role not found', schema: errorSchema },\n        ],\n      },\n      DELETE: {\n        summary: `Remove a ${label} role assignment`,\n        query: roleIdQuerySchema,\n        responses: [{ status: 200, description: 'Role deleted', schema: okResponseSchema }],\n        errors: [\n          { status: 400, description: 'Invalid request', schema: errorSchema },\n          { status: 401, description: 'Unauthorized', schema: errorSchema },\n          { status: 404, description: 'Role not found', schema: errorSchema },\n        ],\n      },\n    },\n  }\n}\n\nexport function createEntityRolesHandlers(entityType: EntityType) {\n  const resourceKind = entityType === 'company' ? 'customers.company' : 'customers.person'\n  const logPrefix = entityType === 'company' ? 'customers.company.roles' : 'customers.person.roles'\n\n  async function GET(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { container, em, auth, scope } = await buildContext(request)\n      const targetScope = await resolveEntityRouteScope(em, auth, scope, entityType, entityId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.view', targetScope.organizationId, translate)\n\n      const roles = await findWithDecryption(\n        em,\n        CustomerEntityRole,\n        {\n          entityType,\n          entityId,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n          deletedAt: null,\n        },\n        { orderBy: { roleType: 'asc' } },\n        {\n          tenantId: targetScope.tenantId,\n          organizationId: targetScope.organizationId,\n        },\n      )\n\n      const userIds = Array.from(new Set(roles.map((role) => role.userId).filter((value): value is string => typeof value === 'string' && value.length > 0)))\n      const users = userIds.length\n        ? await findWithDecryption(\n            em,\n            User,\n            {\n              id: { $in: userIds },\n              deletedAt: null,\n              ...(targetScope.tenantId ? { tenantId: targetScope.tenantId } : {}),\n            },\n            undefined,\n            {\n              tenantId: targetScope.tenantId,\n              organizationId: targetScope.organizationId,\n            },\n          )\n        : []\n      const userMap = new Map(users.map((user) => [user.id, {\n        name: user.name ?? deriveDisplayNameFromEmail(user.email) ?? null,\n        email: user.email ?? null,\n        phone: null,\n      }]))\n\n      return NextResponse.json({\n        items: roles.map((role) => ({\n          ...(userMap.has(role.userId)\n            ? {\n                userName: userMap.get(role.userId)?.name ?? null,\n                userEmail: userMap.get(role.userId)?.email ?? null,\n                userPhone: userMap.get(role.userId)?.phone ?? null,\n              }\n            : {}),\n          id: role.id,\n          entityType: role.entityType,\n          entityId: role.entityId,\n          userId: role.userId,\n          roleType: role.roleType,\n          createdAt: role.createdAt.toISOString(),\n          updatedAt: role.updatedAt.toISOString(),\n        })),\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles GET failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_load_roles', 'Failed to load roles') }, { status: 500 })\n    }\n  }\n\n  async function POST(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveEntityRouteScope(em, auth, scope, entityType, entityId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const rawBody = await readJsonSafe<Record<string, unknown>>(request, {})\n      const scoped = withScopedPayload(\n        {\n          ...rawBody,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n          ...getRoleContext(entityType, entityId),\n        },\n        commandCtx,\n        translate,\n      )\n      const parsed = entityRoleCreateSchema.parse(scoped)\n\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: rawBody,\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { result, logEntry } = await commandBus.execute<EntityRoleCreateInput, { roleId: string }>(\n        'customers.entityRoles.create',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ id: result?.roleId ?? null }, { status: 201 }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles POST failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_assign_role', 'Failed to assign role') }, { status: 500 })\n    }\n  }\n\n  async function PUT(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { roleId } = roleIdQuerySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveRoleRouteScope(em, auth, scope, entityType, entityId, roleId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const rawBody = await readJsonSafe<Record<string, unknown>>(request, {})\n      const scoped = withScopedPayload(\n        {\n          ...rawBody,\n          id: roleId,\n          organizationId: targetScope.organizationId,\n          tenantId: targetScope.tenantId,\n        },\n        commandCtx,\n        translate,\n      )\n      const parsed = entityRoleUpdateSchema.parse(scoped)\n\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: { roleId, ...rawBody },\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { logEntry } = await commandBus.execute<EntityRoleUpdateInput, { roleId: string }>(\n        'customers.entityRoles.update',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ ok: true }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles PUT failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_update_role', 'Failed to update role') }, { status: 500 })\n    }\n  }\n\n  async function DELETE(request: Request, { params }: { params: { id: string } }) {\n    const { translate } = await resolveTranslations()\n    try {\n      const { id: entityId } = paramsSchema.parse(params)\n      const { roleId } = roleIdQuerySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n      const { container, em, auth, scope, ctx } = await buildContext(request)\n      const targetScope = await resolveRoleRouteScope(em, auth, scope, entityType, entityId, roleId, translate)\n      await ensureFeatureOnOrganization(container, auth, 'customers.roles.manage', targetScope.organizationId, translate)\n      const commandCtx = createScopedCommandContext(ctx, targetScope.organizationId)\n\n      const parsed = entityRoleDeleteSchema.parse(\n        withScopedPayload(\n          {\n            id: roleId,\n            organizationId: targetScope.organizationId,\n            tenantId: targetScope.tenantId,\n          },\n          commandCtx,\n          translate,\n        ),\n      )\n      const guardUserId = resolveAuthActorId(auth)\n      const guardResult = await validateCrudMutationGuard(container, {\n        tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n        resourceKind, resourceId: entityId, operation: 'custom',\n        requestMethod: request.method, requestHeaders: request.headers, mutationPayload: { roleId },\n      })\n      if (guardResult && !guardResult.ok) return NextResponse.json(guardResult.body, { status: guardResult.status })\n\n      const commandBus = container.resolve('commandBus') as CommandBus\n      const { logEntry } = await commandBus.execute<EntityRoleDeleteInput, { roleId: string }>(\n        'customers.entityRoles.delete',\n        { input: parsed, ctx: commandCtx },\n      )\n\n      if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n        await runCrudMutationGuardAfterSuccess(container, {\n          tenantId: targetScope.tenantId, organizationId: targetScope.organizationId, userId: guardUserId,\n          resourceKind, resourceId: entityId, operation: 'custom',\n          requestMethod: request.method, requestHeaders: request.headers, metadata: guardResult.metadata ?? null,\n        })\n      }\n\n      return withOperationMetadata(\n        NextResponse.json({ ok: true }),\n        logEntry,\n        { resourceKind, resourceId: entityId },\n      )\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      if (err instanceof z.ZodError) return buildValidationErrorResponse(err, translate)\n      logger.error('Entity roles DELETE failed', { component: logPrefix, err })\n      return NextResponse.json({ error: translate('customers.errors.failed_to_delete_role', 'Failed to delete role') }, { status: 500 })\n    }\n  }\n\n  return { GET, POST, PUT, DELETE }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,wCAAwC;AAC5E,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD,SAAS,yCAAyC;AAClD,SAAS,YAAY;AAErB,SAAS,gBAAgB,0BAA0B;AACnD,SAAS,wBAAwB,wBAAwB,8BAAkH;AAC3K,SAAS,yBAAyB;AAClC,SAAS,gCAAgC,0BAA0B;AACnE,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvD,MAAM,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEhE,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,EAAE,CAAC;AACtE,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrD,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAMlD,SAAS,eAAe,YAAwB,UAAkB;AAChE,QAAM,eAAe,eAAe,YAAY,sBAAsB;AACtE,SAAO,EAAE,YAAY,UAAU,cAAc,YAAY,SAAS;AACpE;AAEA,SAAS,6BAA6B,OAAmB,WAAuB;AAC9E,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,UAAU,qCAAqC,mBAAmB,GAAG,aAAa,MAAM,QAAQ,EAAE,YAAY;AAAA,IACvH,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,aAAa,SAAkB;AAC5C,QAAM,UAAU,MAAM,+BAA+B,OAAO;AAC5D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,QAAQ;AAAA,EACf;AACF;AAEA,SAAS,8BACP,gBACA,OACA,MACA,iBACA;AAKA,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,UAAM,SAAS,eAAe;AAAA,EAChC;AACF;AAEA,eAAe,4BACb,WACA,MACA,SACA,gBACA,WACA;AACA,QAAM,UAAU,mBAAmB,IAAI;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,iCAAiC,cAAc,EAAE,CAAC;AAAA,EACpG;AACA,MAAI;AACJ,MAAI;AACF,WAAO,UAAU,QAAQ,aAAa;AAAA,EACxC,SAAS,KAAK;AACZ,WAAO,MAAM,8BAA8B,EAAE,WAAW,wBAAwB,IAAI,CAAC;AACrF,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,6BAA6B,gBAAgB,EAAE,CAAC;AAAA,EAClG;AACA,QAAM,aAAa,MAAM,KAAK,mBAAmB,SAAS,CAAC,OAAO,GAAG;AAAA,IACnE,UAAU,KAAK;AAAA,IACf;AAAA,EACF,CAAC;AACD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,kCAAkC,eAAe,EAAE,CAAC;AAAA,EACtG;AACF;AAEA,eAAe,wBACb,IACA,MACA,OACA,YACA,UACA,WACA;AACA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,YAAY,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC3E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EACpG;AACA,MAAI,CAAC,UAAU,OAAO,aAAa,KAAK,UAAU;AAChD,UAAM,SAAS,UAAU,uCAAuC,oBAAoB,CAAC;AAAA,EACvF;AACA,gCAA8B,OAAO,gBAAgB,OAAO,MAAM,UAAU,uCAAuC,oBAAoB,CAAC;AACxI,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,UAAU,OAAO;AAAA,EACnB;AACF;AAEA,eAAe,sBACb,IACA,MACA,OACA,YACA,UACA,QACA,WACA;AACA,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,UAAU,KAAK,UAAU,YAAY,UAAU,WAAW,KAAK;AAAA,IAC7E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EACpG;AACA,MACE,CAAC,QACD,KAAK,aAAa,KAAK,YACvB,KAAK,eAAe,cACpB,KAAK,aAAa,UAClB;AACA,UAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,EAC/E;AACA,gCAA8B,KAAK,gBAAgB,OAAO,MAAM,UAAU,mCAAmC,gBAAgB,CAAC;AAC9H,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB;AACF;AAEA,SAAS,2BACP,KACA,gBACA;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,wBAAwB;AAAA,IACxB,iBAAiB,CAAC,cAAc;AAAA,EAClC;AACF;AAEO,MAAM,sBAAsB;AAAA,EACjC,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AAAA,EACpE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACvE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,wBAAwB,EAAE;AAC3E;AAEO,SAAS,wBAAwB,YAAyC;AAC/E,QAAM,QAAQ,eAAe,YAAY,YAAY;AACrD,SAAO;AAAA,IACL,KAAK;AAAA,IACL,SAAS,GAAG,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC,CAAC;AAAA,IAC1D,YAAY;AAAA,IACZ,SAAS;AAAA,MACP,KAAK;AAAA,QACH,SAAS,oBAAoB,KAAK;AAAA,QAClC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB,CAAC;AAAA,QACxF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAClE;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,SAAS,sBAAsB,KAAK;AAAA,QACpC,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,QACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,qBAAqB,CAAC;AAAA,QACtF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,QAC3E;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,SAAS,YAAY,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,aAAa,EAAE,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,QACzE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB,CAAC;AAAA,QAClF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QACpE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,SAAS,YAAY,KAAK;AAAA,QAC1B,OAAO;AAAA,QACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB,CAAC;AAAA,QAClF,QAAQ;AAAA,UACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,UACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,UAChE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QACpE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,0BAA0B,YAAwB;AAChE,QAAM,eAAe,eAAe,YAAY,sBAAsB;AACtE,QAAM,YAAY,eAAe,YAAY,4BAA4B;AAEzE,iBAAe,IAAI,SAAkB,EAAE,OAAO,GAA+B;AAC3E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,WAAW,IAAI,MAAM,MAAM,IAAI,MAAM,aAAa,OAAO;AACjE,YAAM,cAAc,MAAM,wBAAwB,IAAI,MAAM,OAAO,YAAY,UAAU,SAAS;AAClG,YAAM,4BAA4B,WAAW,MAAM,wBAAwB,YAAY,gBAAgB,SAAS;AAEhH,YAAM,QAAQ,MAAM;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,UACE;AAAA,UACA;AAAA,UACA,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,UACtB,WAAW;AAAA,QACb;AAAA,QACA,EAAE,SAAS,EAAE,UAAU,MAAM,EAAE;AAAA,QAC/B;AAAA,UACE,UAAU,YAAY;AAAA,UACtB,gBAAgB,YAAY;AAAA,QAC9B;AAAA,MACF;AAEA,YAAM,UAAU,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,CAAC,CAAC;AACtJ,YAAM,QAAQ,QAAQ,SAClB,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,GAAI,YAAY,WAAW,EAAE,UAAU,YAAY,SAAS,IAAI,CAAC;AAAA,QACnE;AAAA,QACA;AAAA,QACA;AAAA,UACE,UAAU,YAAY;AAAA,UACtB,gBAAgB,YAAY;AAAA,QAC9B;AAAA,MACF,IACA,CAAC;AACL,YAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;AAAA,QACpD,MAAM,KAAK,QAAQ,2BAA2B,KAAK,KAAK,KAAK;AAAA,QAC7D,OAAO,KAAK,SAAS;AAAA,QACrB,OAAO;AAAA,MACT,CAAC,CAAC,CAAC;AAEH,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,UAC1B,GAAI,QAAQ,IAAI,KAAK,MAAM,IACvB;AAAA,YACE,UAAU,QAAQ,IAAI,KAAK,MAAM,GAAG,QAAQ;AAAA,YAC5C,WAAW,QAAQ,IAAI,KAAK,MAAM,GAAG,SAAS;AAAA,YAC9C,WAAW,QAAQ,IAAI,KAAK,MAAM,GAAG,SAAS;AAAA,UAChD,IACA,CAAC;AAAA,UACL,IAAI,KAAK;AAAA,UACT,YAAY,KAAK;AAAA,UACjB,UAAU,KAAK;AAAA,UACf,QAAQ,KAAK;AAAA,UACb,UAAU,KAAK;AAAA,UACf,WAAW,KAAK,UAAU,YAAY;AAAA,UACtC,WAAW,KAAK,UAAU,YAAY;AAAA,QACxC,EAAE;AAAA,MACJ,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,2BAA2B,EAAE,WAAW,WAAW,IAAI,CAAC;AACrE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,yCAAyC,sBAAsB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjI;AAAA,EACF;AAEA,iBAAe,KAAK,SAAkB,EAAE,OAAO,GAA+B;AAC5E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,wBAAwB,IAAI,MAAM,OAAO,YAAY,UAAU,SAAS;AAClG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,UAAU,MAAM,aAAsC,SAAS,CAAC,CAAC;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,UACE,GAAG;AAAA,UACH,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,UACtB,GAAG,eAAe,YAAY,QAAQ;AAAA,QACxC;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,MAAM,MAAM;AAElD,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB;AAAA,MACnF,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,QAC5C;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,QAAQ,UAAU,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjE;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,4BAA4B,EAAE,WAAW,WAAW,IAAI,CAAC;AACtE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,iBAAe,IAAI,SAAkB,EAAE,OAAO,GAA+B;AAC3E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,OAAO,IAAI,kBAAkB,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AAChG,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,OAAO,YAAY,UAAU,QAAQ,SAAS;AACxG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,UAAU,MAAM,aAAsC,SAAS,CAAC,CAAC;AACvE,YAAM,SAAS;AAAA,QACb;AAAA,UACE,GAAG;AAAA,UACH,IAAI;AAAA,UACJ,gBAAgB,YAAY;AAAA,UAC5B,UAAU,YAAY;AAAA,QACxB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,SAAS,uBAAuB,MAAM,MAAM;AAElD,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB,EAAE,QAAQ,GAAG,QAAQ;AAAA,MACxG,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,QACpC;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,QAC9B;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,2BAA2B,EAAE,WAAW,WAAW,IAAI,CAAC;AACrE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,iBAAe,OAAO,SAAkB,EAAE,OAAO,GAA+B;AAC9E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI;AACF,YAAM,EAAE,IAAI,SAAS,IAAI,aAAa,MAAM,MAAM;AAClD,YAAM,EAAE,OAAO,IAAI,kBAAkB,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AAChG,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,aAAa,OAAO;AACtE,YAAM,cAAc,MAAM,sBAAsB,IAAI,MAAM,OAAO,YAAY,UAAU,QAAQ,SAAS;AACxG,YAAM,4BAA4B,WAAW,MAAM,0BAA0B,YAAY,gBAAgB,SAAS;AAClH,YAAM,aAAa,2BAA2B,KAAK,YAAY,cAAc;AAE7E,YAAM,SAAS,uBAAuB;AAAA,QACpC;AAAA,UACE;AAAA,YACE,IAAI;AAAA,YACJ,gBAAgB,YAAY;AAAA,YAC5B,UAAU,YAAY;AAAA,UACxB;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,cAAc,mBAAmB,IAAI;AAC3C,YAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,QAC7D,UAAU,YAAY;AAAA,QAAU,gBAAgB,YAAY;AAAA,QAAgB,QAAQ;AAAA,QACpF;AAAA,QAAc,YAAY;AAAA,QAAU,WAAW;AAAA,QAC/C,eAAe,QAAQ;AAAA,QAAQ,gBAAgB,QAAQ;AAAA,QAAS,iBAAiB,EAAE,OAAO;AAAA,MAC5F,CAAC;AACD,UAAI,eAAe,CAAC,YAAY,GAAI,QAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAE7G,YAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,YAAM,EAAE,SAAS,IAAI,MAAM,WAAW;AAAA,QACpC;AAAA,QACA,EAAE,OAAO,QAAQ,KAAK,WAAW;AAAA,MACnC;AAEA,UAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,cAAM,iCAAiC,WAAW;AAAA,UAChD,UAAU,YAAY;AAAA,UAAU,gBAAgB,YAAY;AAAA,UAAgB,QAAQ;AAAA,UACpF;AAAA,UAAc,YAAY;AAAA,UAAU,WAAW;AAAA,UAC/C,eAAe,QAAQ;AAAA,UAAQ,gBAAgB,QAAQ;AAAA,UAAS,UAAU,YAAY,YAAY;AAAA,QACpG,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,QACL,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,QAC9B;AAAA,QACA,EAAE,cAAc,YAAY,SAAS;AAAA,MACvC;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAI,eAAe,EAAE,SAAU,QAAO,6BAA6B,KAAK,SAAS;AACjF,aAAO,MAAM,8BAA8B,EAAE,WAAW,WAAW,IAAI,CAAC;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0CAA0C,uBAAuB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnI;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,MAAM,KAAK,OAAO;AAClC;",
   "names": []
 }

package/dist/modules/customers/api/interactions/[id]/visibility/route.js

@@ -9,6 +9,7 @@ import {
   runCrudMutationGuardAfterSuccess
 } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CustomerInteraction } from "../../../../data/entities.js";
 import { resolveAuthActorId } from "../../../../lib/interactionRequestContext.js";
 import { emitCustomersEvent } from "../../../../events.js";
@@ -52,7 +53,7 @@ async function PATCH(req, context) {
       interactionType: "email"
     },
     void 0,
-    { tenantId: auth.tenantId, organizationId: scope?.selectedId ?? auth.orgId ?? null }
+    { tenantId: auth.tenantId, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null }
   );
   if (!interaction) {
     return NextResponse.json({ error: "Email not found" }, { status: 404 });