@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/customers/lib/visibilityFilter.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/lib/visibilityFilter.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/postgresql'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { CustomerInteraction } from '../data/entities'\n\n/**\n * The ACL feature that grants admins the right to see private emails authored\n * by other users. Declared in `acl.ts` but granted to NO role in v1 (reserved\n * for the v2 oversight feature \u2014 see `callerHasEmailViewPrivate`).\n */\nexport const EMAIL_VIEW_PRIVATE_FEATURE = 'customers.email.view_private'\n\n/**\n * Returns true when the caller holds the admin override to see ALL private email\n * interactions. Honours wildcards (`customers.*`, `*`).\n *\n * RESERVED FOR v2 \u2014 NOT wired in v1. The v1 model is strict owner-only with no\n * admin bypass: the visibility filters and `canChangeEmailVisibility` ignore\n * caller features, and `customers.email.view_private` is granted to no role.\n * Kept (with {@link EMAIL_VIEW_PRIVATE_FEATURE}) so v2 oversight can opt back in\n * without re-introducing the helper. Do NOT wire this into a read path without\n * an explicit v2 spec.\n */\nexport function callerHasEmailViewPrivate(userFeatures: string[] | null | undefined): boolean {\n  if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false\n  return authorizeFeatures([EMAIL_VIEW_PRIVATE_FEATURE], {\n    grantedFeatures: userFeatures,\n  })\n}\n\n/**\n * Authorization predicate for CHANGING an email interaction's visibility.\n *\n * Personal mailbox privacy (v1: strict owner-only): ONLY the interaction's\n * author may flip their own email between private/shared \u2014 there is no admin\n * bypass. Non-email rows and no-op changes are always allowed. Mirrors the gate\n * in the dedicated `PATCH .../visibility` route so the generic interaction-update\n * path cannot bypass the privacy control. `userFeatures` is reserved for v2.\n */\nexport function canChangeEmailVisibility(opts: {\n  interactionType: string\n  currentVisibility: string | null | undefined\n  nextVisibility: string | null | undefined\n  authorUserId: string | null | undefined\n  actorUserId: string | null | undefined\n  userFeatures: string[] | null | undefined\n}): boolean {\n  if (opts.interactionType !== 'email') return true\n  if ((opts.nextVisibility ?? null) === (opts.currentVisibility ?? null)) return true\n  return Boolean(opts.actorUserId) && opts.authorUserId === opts.actorUserId\n}\n\nexport interface ApplyEmailVisibilityFilterOptions {\n  currentUserId: string | null\n  userFeatures: string[] | null | undefined\n}\n\n/**\n * Adds a `WHERE` predicate to a kysely query so that:\n *   - Non-email interactions (calls, meetings, tasks) pass through unchanged.\n *   - Email interactions with `visibility = 'shared'` are visible to all.\n *   - Email interactions with `visibility = 'private'` are visible ONLY to the\n *     `authorUserId` (channel owner).\n *\n * Personal mailbox privacy (v1: strict owner-only) \u2014 there is NO admin bypass:\n * a private email is hidden from everyone except its author, including\n * admins/superadmins. `opts.userFeatures` is retained for signature stability\n * and reserved for the v2 admin-oversight feature.\n *\n * The function expects a kysely-style builder whose `.where()` accepts an\n * expression-builder callback. Returns the same builder for chaining.\n */\nexport function applyEmailVisibilityFilter<T extends { where: (...args: any[]) => T }>(\n  query: T,\n  opts: ApplyEmailVisibilityFilterOptions,\n): T {\n  const currentUserId = opts.currentUserId\n  // A row is hidden ONLY when it is an email explicitly marked `private` and the\n  // caller is not its author. Everything else stays visible, including:\n  //   - non-email interactions (calls, meetings, tasks),\n  //   - emails marked `shared`,\n  //   - legacy/unset rows where `visibility IS NULL` (e.g. email-log entries\n  //     created before per-email visibility shipped) \u2014 these must remain\n  //     visible to avoid silently hiding pre-existing CRM history.\n  return query.where((eb: any) =>\n    eb.or([\n      eb('interaction_type', '!=', 'email'),\n      eb('visibility', 'is', null),\n      eb('visibility', '!=', 'private'),\n      currentUserId\n        ? eb('author_user_id', '=', currentUserId)\n        : eb.val(false),\n    ]),\n  )\n}\n\ntype RbacServiceLike = {\n  getEffectiveFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[] | undefined>\n}\n\n/**\n * Resolve the caller's granted features (wildcard-aware downstream) so a v2\n * visibility filter could honour the `customers.email.view_private` admin\n * override. Returns `undefined` when there is no user or the RBAC service is\n * unavailable \u2014 callers MUST treat `undefined` as \"no bypass\" (fail closed).\n *\n * RESERVED FOR v2 \u2014 NOT called by any v1 read path. v1 is strict owner-only, so\n * the read routes pass `userFeatures: undefined` to the filters rather than\n * resolving features here (which would be a wasted RBAC round-trip). Re-wire\n * only under an explicit v2 oversight spec.\n */\nexport async function resolveCallerEmailFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  if (!userId) return undefined\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getEffectiveFeatures) return undefined\n    return await rbac.getEffectiveFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * MikroORM equivalent of {@link applyEmailVisibilityFilter}. Returns a\n * `FilterQuery` fragment to merge (implicit AND) into a `CustomerInteraction`\n * where-clause so private email rows are excluded for non-owner, non-admin\n * callers on MikroORM read paths (`findWithDecryption`/`em.find`/`em.count`).\n *\n * Mirrors the kysely predicate exactly, including the legacy `visibility IS NULL`\n * passthrough so pre-existing CRM history is never hidden. Personal mailbox\n * privacy (v1: strict owner-only): no admin bypass \u2014 a private email is hidden\n * from everyone except its author. `opts.userFeatures` is reserved for v2.\n */\nexport type EmailVisibilityMikroFilter = { $or?: FilterQuery<CustomerInteraction>[] }\n\nexport function buildEmailVisibilityMikroFilter(\n  opts: ApplyEmailVisibilityFilterOptions,\n): EmailVisibilityMikroFilter {\n  return {\n    $or: [\n      { interactionType: { $ne: 'email' } },\n      { visibility: null },\n      { visibility: { $ne: 'private' } },\n      ...(opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : []),\n    ],\n  }\n}\n"],
-  "mappings": "AACA,SAAS,yBAAyB;AAQ3B,MAAM,6BAA6B;AAanC,SAAS,0BAA0B,cAAoD;AAC5F,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,EAAG,QAAO;AACtE,SAAO,kBAAkB,CAAC,0BAA0B,GAAG;AAAA,IACrD,iBAAiB;AAAA,EACnB,CAAC;AACH;AAWO,SAAS,yBAAyB,MAO7B;AACV,MAAI,KAAK,oBAAoB,QAAS,QAAO;AAC7C,OAAK,KAAK,kBAAkB,WAAW,KAAK,qBAAqB,MAAO,QAAO;AAC/E,SAAO,QAAQ,KAAK,WAAW,KAAK,KAAK,iBAAiB,KAAK;AACjE;AAsBO,SAAS,2BACd,OACA,MACG;AACH,QAAM,gBAAgB,KAAK;AAQ3B,SAAO,MAAM;AAAA,IAAM,CAAC,OAClB,GAAG,GAAG;AAAA,MACJ,GAAG,oBAAoB,MAAM,OAAO;AAAA,MACpC,GAAG,cAAc,MAAM,IAAI;AAAA,MAC3B,GAAG,cAAc,MAAM,SAAS;AAAA,MAChC,gBACI,GAAG,kBAAkB,KAAK,aAAa,IACvC,GAAG,IAAI,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoBA,eAAsB,2BACpB,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,qBAAsB,QAAO;AACxC,WAAO,MAAM,KAAK,qBAAqB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,SAAS,gCACd,MAC4B;AAC5B,SAAO;AAAA,IACL,KAAK;AAAA,MACH,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE;AAAA,MACpC,EAAE,YAAY,KAAK;AAAA,MACnB,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE;AAAA,MACjC,GAAI,KAAK,gBAAgB,CAAC,EAAE,cAAc,KAAK,cAAc,CAAC,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/postgresql'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { CustomerInteraction } from '../data/entities'\nimport type { ConversationShareGrant } from './conversationShares'\n\n/**\n * The ACL feature that grants admins the right to see private emails authored\n * by other users. Declared in `acl.ts` but granted to NO role in v1 (reserved\n * for the v2 oversight feature \u2014 see `callerHasEmailViewPrivate`).\n */\nexport const EMAIL_VIEW_PRIVATE_FEATURE = 'customers.email.view_private'\n\n/**\n * Returns true when the caller holds the admin override to see ALL private email\n * interactions. Honours wildcards (`customers.*`, `*`).\n *\n * RESERVED FOR v2 \u2014 NOT wired in v1. The v1 model is strict owner-only with no\n * admin bypass: the visibility filters and `canChangeEmailVisibility` ignore\n * caller features, and `customers.email.view_private` is granted to no role.\n * Kept (with {@link EMAIL_VIEW_PRIVATE_FEATURE}) so v2 oversight can opt back in\n * without re-introducing the helper. Do NOT wire this into a read path without\n * an explicit v2 spec.\n */\nexport function callerHasEmailViewPrivate(userFeatures: string[] | null | undefined): boolean {\n  if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false\n  return authorizeFeatures([EMAIL_VIEW_PRIVATE_FEATURE], {\n    grantedFeatures: userFeatures,\n  })\n}\n\n/**\n * Authorization predicate for CHANGING an email interaction's visibility.\n *\n * Personal mailbox privacy (v1: strict owner-only): ONLY the interaction's\n * author may flip their own email between private/shared \u2014 there is no admin\n * bypass. Non-email rows and no-op changes are always allowed. Mirrors the gate\n * in the dedicated `PATCH .../visibility` route so the generic interaction-update\n * path cannot bypass the privacy control. `userFeatures` is reserved for v2.\n */\nexport function canChangeEmailVisibility(opts: {\n  interactionType: string\n  currentVisibility: string | null | undefined\n  nextVisibility: string | null | undefined\n  authorUserId: string | null | undefined\n  actorUserId: string | null | undefined\n  userFeatures: string[] | null | undefined\n}): boolean {\n  if (opts.interactionType !== 'email') return true\n  if ((opts.nextVisibility ?? null) === (opts.currentVisibility ?? null)) return true\n  return Boolean(opts.actorUserId) && opts.authorUserId === opts.actorUserId\n}\n\nexport interface ApplyEmailVisibilityFilterOptions {\n  currentUserId: string | null\n  userFeatures: string[] | null | undefined\n  /**\n   * Conversation shares that widen what this caller may read: each grant means\n   * \"the owner of this mailbox handed their email history with this Person to the\n   * team\" (`lib/conversationShares.ts`).\n   *\n   * OPTIONAL and fail-closed by design \u2014 omitting it (or passing `[]`) yields the\n   * byte-identical strict owner-only predicate that shipped in v1, so a read path\n   * that has not been taught about sharing can only ever under-share.\n   */\n  sharedConversations?: ConversationShareGrant[]\n  /**\n   * Ids of channels the caller may read in full because their owner marked them\n   * as a shared team mailbox (`CommunicationChannel.visibility = 'shared'`).\n   *\n   * Matched against the denormalized `customer_interactions.channel_id`, NOT\n   * against `author_user_id`: an owner with one shared and one private mailbox has\n   * the same author on both, so an author-keyed rule would leak the private one.\n   *\n   * OPTIONAL and fail-closed \u2014 omitting it (or passing `[]`) yields the predicate\n   * as it stood before channel sharing existed, so an unconverted read path can\n   * only ever under-share. A row with `channel_id IS NULL` never matches.\n   */\n  sharedChannelIds?: string[]\n}\n\n/**\n * Adds a `WHERE` predicate to a kysely query so that:\n *   - Non-email interactions (calls, meetings, tasks) pass through unchanged.\n *   - Email interactions with `visibility = 'shared'` are visible to all.\n *   - Email interactions with `visibility = 'private'` are visible ONLY to the\n *     `authorUserId` (channel owner).\n *\n * Personal mailbox privacy (v1: strict owner-only) \u2014 there is NO admin bypass:\n * a private email is hidden from everyone except its author, including\n * admins/superadmins. `opts.userFeatures` is retained for signature stability\n * and reserved for the v2 admin-oversight feature.\n *\n * The function expects a kysely-style builder whose `.where()` accepts an\n * expression-builder callback. Returns the same builder for chaining.\n */\nexport function applyEmailVisibilityFilter<T extends { where: (...args: any[]) => T }>(\n  query: T,\n  opts: ApplyEmailVisibilityFilterOptions,\n): T {\n  const currentUserId = opts.currentUserId\n  // A row is hidden ONLY when it is an email explicitly marked `private` and the\n  // caller is not its author. Everything else stays visible, including:\n  //   - non-email interactions (calls, meetings, tasks),\n  //   - emails marked `shared`,\n  //   - legacy/unset rows where `visibility IS NULL` (e.g. email-log entries\n  //     created before per-email visibility shipped) \u2014 these must remain\n  //     visible to avoid silently hiding pre-existing CRM history.\n  const grants = opts.sharedConversations ?? []\n  const sharedChannelIds = opts.sharedChannelIds ?? []\n  return query.where((eb: any) =>\n    eb.or([\n      eb('interaction_type', '!=', 'email'),\n      eb('visibility', 'is', null),\n      eb('visibility', '!=', 'private'),\n      currentUserId\n        ? eb('author_user_id', '=', currentUserId)\n        : eb.val(false),\n      // Conversation shares: the owner handed their history with this Person to\n      // the team. One arm per grant, each an AND of the two columns the covering\n      // index already leads with.\n      ...grants.map((grant) =>\n        eb.and([\n          eb('entity_id', '=', grant.personEntityId),\n          eb('author_user_id', '=', grant.ownerUserId),\n        ]),\n      ),\n      // Shared team mailboxes: the whole channel was handed to the team. One arm\n      // for the whole set, matching the indexed `channel_id` column.\n      ...(sharedChannelIds.length > 0\n        ? [eb('channel_id', 'in', sharedChannelIds)]\n        : []),\n    ]),\n  )\n}\n\n/**\n * Row-level predicate: is this email interaction HIDDEN from the caller?\n *\n * The exact logical complement of {@link applyEmailVisibilityFilter}, extracted so\n * every enforcement point derives from one definition of the rule. Any change to\n * the visibility predicate MUST be mirrored here and in\n * {@link applyEmailHiddenFilter} in the same commit \u2014 the unit tests assert the\n * three agree on a shared row matrix.\n */\nexport function isEmailHiddenFrom(opts: {\n  interactionType: string | null | undefined\n  visibility: string | null | undefined\n  authorUserId: string | null | undefined\n  currentUserId: string | null | undefined\n  /** The Person this interaction is anchored to; required to match a share grant. */\n  personEntityId?: string | null | undefined\n  sharedConversations?: ConversationShareGrant[]\n  /** The channel this email arrived through; required to match a shared mailbox. */\n  channelId?: string | null | undefined\n  sharedChannelIds?: string[]\n}): boolean {\n  if (opts.interactionType !== 'email') return false\n  if (opts.visibility !== 'private') return false\n  if (opts.currentUserId && opts.authorUserId && opts.authorUserId === opts.currentUserId) {\n    return false\n  }\n  // A shared team mailbox makes every one of its rows readable. Checked before the\n  // per-Person grants because it is the broader escalation.\n  const sharedChannelIds = opts.sharedChannelIds ?? []\n  if (sharedChannelIds.length > 0 && opts.channelId && sharedChannelIds.includes(opts.channelId)) {\n    return false\n  }\n  const grants = opts.sharedConversations ?? []\n  if (grants.length > 0 && opts.personEntityId && opts.authorUserId) {\n    const shared = grants.some(\n      (grant) =>\n        grant.personEntityId === opts.personEntityId && grant.ownerUserId === opts.authorUserId,\n    )\n    if (shared) return false\n  }\n  return true\n}\n\n/**\n * Kysely complement of {@link applyEmailVisibilityFilter}: narrows a query to the\n * email rows the caller may NOT read. Used to count another user's private email\n * without duplicating the rule in raw SQL.\n *\n * Note the SQL NULL semantics deliberately preserved from the original inline\n * query: `author_user_id != caller` does not match rows whose author is NULL, so a\n * private row with no author is neither visible nor counted. Private rows always\n * carry the channel owner as author, so this is unreachable in practice; it is\n * documented rather than \"fixed\" so counts do not shift silently.\n */\nexport function applyEmailHiddenFilter<T extends { where: (...args: any[]) => T }>(\n  query: T,\n  opts: ApplyEmailVisibilityFilterOptions,\n): T {\n  const currentUserId = opts.currentUserId\n  const grants = opts.sharedConversations ?? []\n  const sharedChannelIds = opts.sharedChannelIds ?? []\n  return query\n    .where('interaction_type', '=', 'email')\n    .where('visibility', '=', 'private')\n    .where((eb: any) =>\n      currentUserId ? eb('author_user_id', '!=', currentUserId) : eb.val(true),\n    )\n    // Subtract shared team mailboxes, or the Person page would keep reporting\n    // \"3 private emails\" for a mailbox the caller can now read end to end.\n    // `channel_id IS NULL` must still COUNT, so the NULL case is explicit rather\n    // than left to SQL's three-valued `not in`.\n    .where((eb: any) =>\n      sharedChannelIds.length === 0\n        ? eb.val(true)\n        : eb.or([\n            eb('channel_id', 'is', null),\n            eb('channel_id', 'not in', sharedChannelIds),\n          ]),\n    )\n    // Subtract the shared conversations. Without this the Person page would keep\n    // reporting \"3 private emails\" for emails the caller can now actually read.\n    .where((eb: any) =>\n      grants.length === 0\n        ? eb.val(true)\n        : eb.and(\n            grants.map((grant) =>\n              eb.or([\n                eb('entity_id', '!=', grant.personEntityId),\n                eb('author_user_id', '!=', grant.ownerUserId),\n              ]),\n            ),\n          ),\n    )\n}\n\ntype RbacServiceLike = {\n  getEffectiveFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[] | undefined>\n}\n\n/**\n * Resolve the caller's granted features (wildcard-aware downstream) so a v2\n * visibility filter could honour the `customers.email.view_private` admin\n * override. Returns `undefined` when there is no user or the RBAC service is\n * unavailable \u2014 callers MUST treat `undefined` as \"no bypass\" (fail closed).\n *\n * RESERVED FOR v2 \u2014 NOT called by any v1 read path. v1 is strict owner-only, so\n * the read routes pass `userFeatures: undefined` to the filters rather than\n * resolving features here (which would be a wasted RBAC round-trip). Re-wire\n * only under an explicit v2 oversight spec.\n */\nexport async function resolveCallerEmailFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  if (!userId) return undefined\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getEffectiveFeatures) return undefined\n    return await rbac.getEffectiveFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * MikroORM equivalent of {@link applyEmailVisibilityFilter}. Returns a\n * `FilterQuery` fragment to merge (implicit AND) into a `CustomerInteraction`\n * where-clause so private email rows are excluded for non-owner, non-admin\n * callers on MikroORM read paths (`findWithDecryption`/`em.find`/`em.count`).\n *\n * Mirrors the kysely predicate exactly, including the legacy `visibility IS NULL`\n * passthrough so pre-existing CRM history is never hidden. Personal mailbox\n * privacy (v1: strict owner-only): no admin bypass \u2014 a private email is hidden\n * from everyone except its author. `opts.userFeatures` is reserved for v2.\n */\n/**\n * @deprecated Use {@link EmailVisibilityFilterFragment}. The old shape exposed\n * `$or` as the only possible key, which invited callers to consume the fragment\n * as `where.$or = build(...).$or` and silently drop any other arm the predicate\n * grows. Retained for one minor per the deprecation protocol in\n * `BACKWARD_COMPATIBILITY.md`.\n */\nexport type EmailVisibilityMikroFilter = EmailVisibilityFilterFragment\n\n/**\n * Opaque where-fragment to merge (implicit AND) into a `CustomerInteraction`\n * where-clause. Callers MUST merge the WHOLE fragment \u2014 `{ ...fragment }` or\n * `Object.assign(where, fragment)` \u2014 and never cherry-pick a single key, so the\n * predicate can grow arms without leaking private rows at compile-clean call\n * sites.\n */\nexport type EmailVisibilityFilterFragment = { $or: FilterQuery<CustomerInteraction>[] }\n\nexport function buildEmailVisibilityMikroFilter(\n  opts: ApplyEmailVisibilityFilterOptions,\n): EmailVisibilityFilterFragment {\n  // Deliberately a SINGLE `$or` key. Several callers merge this fragment by\n  // object spread into a where-clause that may itself carry other keys; keeping\n  // the whole predicate inside one `$or` means such a spread can never split the\n  // predicate into independently-satisfiable arms. Any future widening MUST be\n  // added as another arm of THIS `$or`, not as a sibling top-level key.\n  const grants = opts.sharedConversations ?? []\n  const sharedChannelIds = opts.sharedChannelIds ?? []\n  return {\n    $or: [\n      { interactionType: { $ne: 'email' } },\n      { visibility: null },\n      { visibility: { $ne: 'private' } },\n      ...(opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : []),\n      // Mirrors the kysely share arm: one AND-pair per grant, kept flat inside\n      // this single `$or` so the fragment stays a one-key object.\n      ...grants.map((grant) => ({\n        entity: grant.personEntityId,\n        authorUserId: grant.ownerUserId,\n      })),\n      // Mirrors the kysely channel arm. Still flat inside this single `$or`, so\n      // the fragment stays a one-key object every caller can spread losslessly.\n      ...(sharedChannelIds.length > 0 ? [{ channelId: { $in: sharedChannelIds } }] : []),\n    ],\n  } as EmailVisibilityFilterFragment\n}\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AAS3B,MAAM,6BAA6B;AAanC,SAAS,0BAA0B,cAAoD;AAC5F,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,EAAG,QAAO;AACtE,SAAO,kBAAkB,CAAC,0BAA0B,GAAG;AAAA,IACrD,iBAAiB;AAAA,EACnB,CAAC;AACH;AAWO,SAAS,yBAAyB,MAO7B;AACV,MAAI,KAAK,oBAAoB,QAAS,QAAO;AAC7C,OAAK,KAAK,kBAAkB,WAAW,KAAK,qBAAqB,MAAO,QAAO;AAC/E,SAAO,QAAQ,KAAK,WAAW,KAAK,KAAK,iBAAiB,KAAK;AACjE;AA6CO,SAAS,2BACd,OACA,MACG;AACH,QAAM,gBAAgB,KAAK;AAQ3B,QAAM,SAAS,KAAK,uBAAuB,CAAC;AAC5C,QAAM,mBAAmB,KAAK,oBAAoB,CAAC;AACnD,SAAO,MAAM;AAAA,IAAM,CAAC,OAClB,GAAG,GAAG;AAAA,MACJ,GAAG,oBAAoB,MAAM,OAAO;AAAA,MACpC,GAAG,cAAc,MAAM,IAAI;AAAA,MAC3B,GAAG,cAAc,MAAM,SAAS;AAAA,MAChC,gBACI,GAAG,kBAAkB,KAAK,aAAa,IACvC,GAAG,IAAI,KAAK;AAAA;AAAA;AAAA;AAAA,MAIhB,GAAG,OAAO;AAAA,QAAI,CAAC,UACb,GAAG,IAAI;AAAA,UACL,GAAG,aAAa,KAAK,MAAM,cAAc;AAAA,UACzC,GAAG,kBAAkB,KAAK,MAAM,WAAW;AAAA,QAC7C,CAAC;AAAA,MACH;AAAA;AAAA;AAAA,MAGA,GAAI,iBAAiB,SAAS,IAC1B,CAAC,GAAG,cAAc,MAAM,gBAAgB,CAAC,IACzC,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AACF;AAWO,SAAS,kBAAkB,MAWtB;AACV,MAAI,KAAK,oBAAoB,QAAS,QAAO;AAC7C,MAAI,KAAK,eAAe,UAAW,QAAO;AAC1C,MAAI,KAAK,iBAAiB,KAAK,gBAAgB,KAAK,iBAAiB,KAAK,eAAe;AACvF,WAAO;AAAA,EACT;AAGA,QAAM,mBAAmB,KAAK,oBAAoB,CAAC;AACnD,MAAI,iBAAiB,SAAS,KAAK,KAAK,aAAa,iBAAiB,SAAS,KAAK,SAAS,GAAG;AAC9F,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,uBAAuB,CAAC;AAC5C,MAAI,OAAO,SAAS,KAAK,KAAK,kBAAkB,KAAK,cAAc;AACjE,UAAM,SAAS,OAAO;AAAA,MACpB,CAAC,UACC,MAAM,mBAAmB,KAAK,kBAAkB,MAAM,gBAAgB,KAAK;AAAA,IAC/E;AACA,QAAI,OAAQ,QAAO;AAAA,EACrB;AACA,SAAO;AACT;AAaO,SAAS,uBACd,OACA,MACG;AACH,QAAM,gBAAgB,KAAK;AAC3B,QAAM,SAAS,KAAK,uBAAuB,CAAC;AAC5C,QAAM,mBAAmB,KAAK,oBAAoB,CAAC;AACnD,SAAO,MACJ,MAAM,oBAAoB,KAAK,OAAO,EACtC,MAAM,cAAc,KAAK,SAAS,EAClC;AAAA,IAAM,CAAC,OACN,gBAAgB,GAAG,kBAAkB,MAAM,aAAa,IAAI,GAAG,IAAI,IAAI;AAAA,EACzE,EAKC;AAAA,IAAM,CAAC,OACN,iBAAiB,WAAW,IACxB,GAAG,IAAI,IAAI,IACX,GAAG,GAAG;AAAA,MACJ,GAAG,cAAc,MAAM,IAAI;AAAA,MAC3B,GAAG,cAAc,UAAU,gBAAgB;AAAA,IAC7C,CAAC;AAAA,EACP,EAGC;AAAA,IAAM,CAAC,OACN,OAAO,WAAW,IACd,GAAG,IAAI,IAAI,IACX,GAAG;AAAA,MACD,OAAO;AAAA,QAAI,CAAC,UACV,GAAG,GAAG;AAAA,UACJ,GAAG,aAAa,MAAM,MAAM,cAAc;AAAA,UAC1C,GAAG,kBAAkB,MAAM,MAAM,WAAW;AAAA,QAC9C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACN;AACJ;AAoBA,eAAsB,2BACpB,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,qBAAsB,QAAO;AACxC,WAAO,MAAM,KAAK,qBAAqB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA+BO,SAAS,gCACd,MAC+B;AAM/B,QAAM,SAAS,KAAK,uBAAuB,CAAC;AAC5C,QAAM,mBAAmB,KAAK,oBAAoB,CAAC;AACnD,SAAO;AAAA,IACL,KAAK;AAAA,MACH,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE;AAAA,MACpC,EAAE,YAAY,KAAK;AAAA,MACnB,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE;AAAA,MACjC,GAAI,KAAK,gBAAgB,CAAC,EAAE,cAAc,KAAK,cAAc,CAAC,IAAI,CAAC;AAAA;AAAA;AAAA,MAGnE,GAAG,OAAO,IAAI,CAAC,WAAW;AAAA,QACxB,QAAQ,MAAM;AAAA,QACd,cAAc,MAAM;AAAA,MACtB,EAAE;AAAA;AAAA;AAAA,MAGF,GAAI,iBAAiB,SAAS,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC,IAAI,CAAC;AAAA,IAClF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/migrations/Migration20260825120000_customers.js

@@ -0,0 +1,18 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260825120000_customers extends Migration {
+  async up() {
+    this.addSql(`create table "customer_email_conversation_shares" ("id" uuid not null default gen_random_uuid(), "organization_id" uuid not null, "tenant_id" uuid not null, "person_entity_id" uuid not null, "owner_user_id" uuid not null, "shared_by_user_id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz null, "deleted_at" timestamptz null, constraint "customer_email_conversation_shares_pkey" primary key ("id"));`);
+    this.addSql(`create index "customer_email_conv_shares_lookup_idx" on "customer_email_conversation_shares" ("tenant_id", "organization_id", "person_entity_id") where "deleted_at" is null;`);
+    this.addSql(`create index "customer_email_conv_shares_owner_idx" on "customer_email_conversation_shares" ("tenant_id", "owner_user_id") where "deleted_at" is null;`);
+    this.addSql(`create unique index "customer_email_conv_shares_uq" on "customer_email_conversation_shares" ("tenant_id", "person_entity_id", "owner_user_id") where "deleted_at" is null;`);
+    this.addSql(`alter table "customer_email_conversation_shares" add constraint "customer_email_conversation_shares_person_entity_id_foreign" foreign key ("person_entity_id") references "customer_entities" ("id") on update cascade;`);
+  }
+  async down() {
+    this.addSql(`alter table "customer_email_conversation_shares" drop constraint if exists "customer_email_conversation_shares_person_entity_id_foreign";`);
+    this.addSql(`drop table if exists "customer_email_conversation_shares" cascade;`);
+  }
+}
+export {
+  Migration20260825120000_customers
+};
+//# sourceMappingURL=Migration20260825120000_customers.js.map

package/dist/modules/customers/migrations/Migration20260825120000_customers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/migrations/Migration20260825120000_customers.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260825120000_customers extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`create table \"customer_email_conversation_shares\" (\"id\" uuid not null default gen_random_uuid(), \"organization_id\" uuid not null, \"tenant_id\" uuid not null, \"person_entity_id\" uuid not null, \"owner_user_id\" uuid not null, \"shared_by_user_id\" uuid not null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz null, \"deleted_at\" timestamptz null, constraint \"customer_email_conversation_shares_pkey\" primary key (\"id\"));`);\n    this.addSql(`create index \"customer_email_conv_shares_lookup_idx\" on \"customer_email_conversation_shares\" (\"tenant_id\", \"organization_id\", \"person_entity_id\") where \"deleted_at\" is null;`);\n    this.addSql(`create index \"customer_email_conv_shares_owner_idx\" on \"customer_email_conversation_shares\" (\"tenant_id\", \"owner_user_id\") where \"deleted_at\" is null;`);\n    this.addSql(`create unique index \"customer_email_conv_shares_uq\" on \"customer_email_conversation_shares\" (\"tenant_id\", \"person_entity_id\", \"owner_user_id\") where \"deleted_at\" is null;`);\n\n    this.addSql(`alter table \"customer_email_conversation_shares\" add constraint \"customer_email_conversation_shares_person_entity_id_foreign\" foreign key (\"person_entity_id\") references \"customer_entities\" (\"id\") on update cascade;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`alter table \"customer_email_conversation_shares\" drop constraint if exists \"customer_email_conversation_shares_person_entity_id_foreign\";`);\n    this.addSql(`drop table if exists \"customer_email_conversation_shares\" cascade;`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,0CAA0C,UAAU;AAAA,EAE/D,MAAe,KAAoB;AACjC,SAAK,OAAO,6aAA6a;AACzb,SAAK,OAAO,+KAA+K;AAC3L,SAAK,OAAO,wJAAwJ;AACpK,SAAK,OAAO,4KAA4K;AAExL,SAAK,OAAO,yNAAyN;AAAA,EACvO;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,2IAA2I;AACvJ,SAAK,OAAO,oEAAoE;AAAA,EAClF;AAEF;",
+  "names": []
+}

package/dist/modules/customers/migrations/Migration20260825140000_customers.js

@@ -0,0 +1,27 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260825140000_customers extends Migration {
+  async up() {
+    this.addSql(`alter table "customer_interactions" add column "channel_id" uuid null;`);
+    this.addSql(`
+      update "customer_interactions" ci
+      set "channel_id" = ec."channel_id"
+      from "message_channel_links" mcl
+      join "external_conversations" ec
+        on ec."id" = mcl."external_conversation_id"
+       and ec."tenant_id" = mcl."tenant_id"
+      where ci."external_message_id" = mcl."id"
+        and ci."tenant_id" = mcl."tenant_id"
+        and ci."interaction_type" = 'email'
+        and ci."channel_id" is null;
+    `);
+    this.addSql(`create index "customer_interactions_email_channel_idx" on "customer_interactions" ("channel_id", "entity_id") where "interaction_type" = 'email' and "channel_id" is not null and "deleted_at" is null;`);
+  }
+  async down() {
+    this.addSql(`drop index if exists "customer_interactions_email_channel_idx";`);
+    this.addSql(`alter table "customer_interactions" drop column if exists "channel_id";`);
+  }
+}
+export {
+  Migration20260825140000_customers
+};
+//# sourceMappingURL=Migration20260825140000_customers.js.map

package/dist/modules/customers/migrations/Migration20260825140000_customers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/migrations/Migration20260825140000_customers.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260825140000_customers extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"customer_interactions\" add column \"channel_id\" uuid null;`);\n\n    // Backfill the denormalized channel id for pre-existing email rows.\n    //\n    // This is the only available chain \u2014 `message_channel_links` carries no\n    // channel id of its own:\n    //   customer_interactions.external_message_id -> message_channel_links.id\n    //   message_channel_links.external_conversation_id -> external_conversations.id\n    //   external_conversations.channel_id -> communication_channels.id\n    //\n    // Rows whose chain cannot be resolved keep channel_id NULL, which every read\n    // predicate treats as \"not shared\" (fail closed). Scoped by tenant on both\n    // joins so a backfill can never attribute an interaction to another tenant's\n    // channel.\n    this.addSql(`\n      update \"customer_interactions\" ci\n      set \"channel_id\" = ec.\"channel_id\"\n      from \"message_channel_links\" mcl\n      join \"external_conversations\" ec\n        on ec.\"id\" = mcl.\"external_conversation_id\"\n       and ec.\"tenant_id\" = mcl.\"tenant_id\"\n      where ci.\"external_message_id\" = mcl.\"id\"\n        and ci.\"tenant_id\" = mcl.\"tenant_id\"\n        and ci.\"interaction_type\" = 'email'\n        and ci.\"channel_id\" is null;\n    `);\n\n    this.addSql(`create index \"customer_interactions_email_channel_idx\" on \"customer_interactions\" (\"channel_id\", \"entity_id\") where \"interaction_type\" = 'email' and \"channel_id\" is not null and \"deleted_at\" is null;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`drop index if exists \"customer_interactions_email_channel_idx\";`);\n    this.addSql(`alter table \"customer_interactions\" drop column if exists \"channel_id\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,0CAA0C,UAAU;AAAA,EAE/D,MAAe,KAAoB;AACjC,SAAK,OAAO,wEAAwE;AAcpF,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAWX;AAED,SAAK,OAAO,yMAAyM;AAAA,EACvN;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,iEAAiE;AAC7E,SAAK,OAAO,yEAAyE;AAAA,EACvF;AAEF;",
+  "names": []
+}

package/dist/modules/customers/setup.js

@@ -101,6 +101,7 @@ const setup = {
       "customers.roles.view",
       "customers.roles.manage",
       "customers.email.compose",
+      "customers.email.share_conversation",
       // Required so the staff-absent fallback to /api/auth/users succeeds for employees too.
       // See `admin` entry above for full rationale.
       "auth.users.list"

package/dist/modules/customers/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customers/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FeatureToggle } from '@open-mercato/core/modules/feature_toggles/data/entities'\nimport {\n  ensureCustomerCustomFieldDefinitions,\n  seedCustomerDictionaries,\n  seedCurrencyDictionary,\n  seedCustomerExamples,\n  seedDefaultPipeline,\n} from './cli'\nimport { ensureDictionaryEntry } from './commands/shared'\nimport { DEFAULT_CUSTOMER_ROLE_TYPES } from './lib/customerRoleTypes'\n\nconst interactionFeatureToggles = [\n  {\n    identifier: 'customers.interactions.unified',\n    name: 'Unified Interactions',\n    description: 'When enabled, interactions use the unified canonical model instead of per-entity activity tracking.',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: false,\n  },\n  {\n    identifier: 'customers.interactions.legacy-adapters',\n    name: 'Interaction Legacy Adapters',\n    description: 'When enabled, legacy activity/todo APIs are bridged to the canonical interaction model.',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: true,\n  },\n  {\n    identifier: 'customers.interactions.external-sync',\n    name: 'Interaction External Sync',\n    description: 'When enabled, interactions can be synced from external systems (calendars, email providers).',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: false,\n  },\n]\n\nasync function seedInteractionFeatureToggles(em: EntityManager): Promise<void> {\n  for (const toggle of interactionFeatureToggles) {\n    const existing = await em.findOne(FeatureToggle, { identifier: toggle.identifier, deletedAt: null })\n    if (existing) continue\n    const entity = em.create(FeatureToggle, {\n      identifier: toggle.identifier,\n      name: toggle.name,\n      description: toggle.description,\n      category: toggle.category,\n      type: toggle.type,\n      defaultValue: toggle.defaultValue,\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  seedDefaults: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    await seedCustomerDictionaries(ctx.em, scope)\n    await seedCurrencyDictionary(ctx.em, scope)\n    await seedDefaultPipeline(ctx.em, scope)\n    await ensureCustomerCustomFieldDefinitions(ctx.em, ctx.tenantId)\n    await seedInteractionFeatureToggles(ctx.em)\n    for (const entry of DEFAULT_CUSTOMER_ROLE_TYPES) {\n      await ensureDictionaryEntry(ctx.em, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        kind: 'customer_role_type',\n        value: entry.value,\n        label: entry.label,\n        color: entry.color,\n        icon: entry.icon,\n      })\n    }\n  },\n\n  seedExamples: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    await seedCustomerExamples(ctx.em, ctx.container, scope)\n  },\n\n  defaultRoleFeatures: {\n    admin: [\n      'customers.*',\n      // `auth.users.list` is granted alongside `customers.*` so the owner picker resolves\n      // user names in CRM-preset apps where the optional `staff` module is absent.\n      // Without it the fallback to /api/auth/users returns 403 and owners show as \"Unknown\".\n      // Existing tenants pick this up via `yarn mercato auth sync-role-acls`.\n      'auth.users.list',\n    ],\n    employee: [\n      'customers.people.view',\n      'customers.people.manage',\n      'customers.companies.view',\n      'customers.companies.manage',\n      'customers.deals.view',\n      'customers.deals.manage',\n      'customers.activities.view',\n      'customers.activities.manage',\n      'customers.pipelines.view',\n      'customers.interactions.view',\n      'customers.widgets.todos',\n      'customers.widgets.next-interactions',\n      'customers.widgets.new-customers',\n      'customers.widgets.new-deals',\n      'customers.roles.view',\n      'customers.roles.manage',\n      'customers.email.compose',\n      // Required so the staff-absent fallback to /api/auth/users succeeds for employees too.\n      // See `admin` entry above for full rationale.\n      'auth.users.list',\n    ],\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAEA,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAE5C,MAAM,4BAA4B;AAAA,EAChC;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,eAAe,8BAA8B,IAAkC;AAC7E,aAAW,UAAU,2BAA2B;AAC9C,UAAM,WAAW,MAAM,GAAG,QAAQ,eAAe,EAAE,YAAY,OAAO,YAAY,WAAW,KAAK,CAAC;AACnG,QAAI,SAAU;AACd,UAAM,SAAS,GAAG,OAAO,eAAe;AAAA,MACtC,YAAY,OAAO;AAAA,MACnB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO;AAAA,MACb,cAAc,OAAO;AAAA,IACvB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,yBAAyB,IAAI,IAAI,KAAK;AAC5C,UAAM,uBAAuB,IAAI,IAAI,KAAK;AAC1C,UAAM,oBAAoB,IAAI,IAAI,KAAK;AACvC,UAAM,qCAAqC,IAAI,IAAI,IAAI,QAAQ;AAC/D,UAAM,8BAA8B,IAAI,EAAE;AAC1C,eAAW,SAAS,6BAA6B;AAC/C,YAAM,sBAAsB,IAAI,IAAI;AAAA,QAClC,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,MAAM;AAAA,QACN,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,qBAAqB,IAAI,IAAI,IAAI,WAAW,KAAK;AAAA,EACzD;AAAA,EAEA,qBAAqB;AAAA,IACnB,OAAO;AAAA,MACL;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FeatureToggle } from '@open-mercato/core/modules/feature_toggles/data/entities'\nimport {\n  ensureCustomerCustomFieldDefinitions,\n  seedCustomerDictionaries,\n  seedCurrencyDictionary,\n  seedCustomerExamples,\n  seedDefaultPipeline,\n} from './cli'\nimport { ensureDictionaryEntry } from './commands/shared'\nimport { DEFAULT_CUSTOMER_ROLE_TYPES } from './lib/customerRoleTypes'\n\nconst interactionFeatureToggles = [\n  {\n    identifier: 'customers.interactions.unified',\n    name: 'Unified Interactions',\n    description: 'When enabled, interactions use the unified canonical model instead of per-entity activity tracking.',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: false,\n  },\n  {\n    identifier: 'customers.interactions.legacy-adapters',\n    name: 'Interaction Legacy Adapters',\n    description: 'When enabled, legacy activity/todo APIs are bridged to the canonical interaction model.',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: true,\n  },\n  {\n    identifier: 'customers.interactions.external-sync',\n    name: 'Interaction External Sync',\n    description: 'When enabled, interactions can be synced from external systems (calendars, email providers).',\n    category: 'customers',\n    type: 'boolean' as const,\n    defaultValue: false,\n  },\n]\n\nasync function seedInteractionFeatureToggles(em: EntityManager): Promise<void> {\n  for (const toggle of interactionFeatureToggles) {\n    const existing = await em.findOne(FeatureToggle, { identifier: toggle.identifier, deletedAt: null })\n    if (existing) continue\n    const entity = em.create(FeatureToggle, {\n      identifier: toggle.identifier,\n      name: toggle.name,\n      description: toggle.description,\n      category: toggle.category,\n      type: toggle.type,\n      defaultValue: toggle.defaultValue,\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  seedDefaults: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    await seedCustomerDictionaries(ctx.em, scope)\n    await seedCurrencyDictionary(ctx.em, scope)\n    await seedDefaultPipeline(ctx.em, scope)\n    await ensureCustomerCustomFieldDefinitions(ctx.em, ctx.tenantId)\n    await seedInteractionFeatureToggles(ctx.em)\n    for (const entry of DEFAULT_CUSTOMER_ROLE_TYPES) {\n      await ensureDictionaryEntry(ctx.em, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        kind: 'customer_role_type',\n        value: entry.value,\n        label: entry.label,\n        color: entry.color,\n        icon: entry.icon,\n      })\n    }\n  },\n\n  seedExamples: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    await seedCustomerExamples(ctx.em, ctx.container, scope)\n  },\n\n  defaultRoleFeatures: {\n    admin: [\n      'customers.*',\n      // `auth.users.list` is granted alongside `customers.*` so the owner picker resolves\n      // user names in CRM-preset apps where the optional `staff` module is absent.\n      // Without it the fallback to /api/auth/users returns 403 and owners show as \"Unknown\".\n      // Existing tenants pick this up via `yarn mercato auth sync-role-acls`.\n      'auth.users.list',\n    ],\n    employee: [\n      'customers.people.view',\n      'customers.people.manage',\n      'customers.companies.view',\n      'customers.companies.manage',\n      'customers.deals.view',\n      'customers.deals.manage',\n      'customers.activities.view',\n      'customers.activities.manage',\n      'customers.pipelines.view',\n      'customers.interactions.view',\n      'customers.widgets.todos',\n      'customers.widgets.next-interactions',\n      'customers.widgets.new-customers',\n      'customers.widgets.new-deals',\n      'customers.roles.view',\n      'customers.roles.manage',\n      'customers.email.compose',\n      'customers.email.share_conversation',\n      // Required so the staff-absent fallback to /api/auth/users succeeds for employees too.\n      // See `admin` entry above for full rationale.\n      'auth.users.list',\n    ],\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAEA,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B;AACtC,SAAS,mCAAmC;AAE5C,MAAM,4BAA4B;AAAA,EAChC;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AAAA,EACA;AAAA,IACE,YAAY;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,eAAe,8BAA8B,IAAkC;AAC7E,aAAW,UAAU,2BAA2B;AAC9C,UAAM,WAAW,MAAM,GAAG,QAAQ,eAAe,EAAE,YAAY,OAAO,YAAY,WAAW,KAAK,CAAC;AACnG,QAAI,SAAU;AACd,UAAM,SAAS,GAAG,OAAO,eAAe;AAAA,MACtC,YAAY,OAAO;AAAA,MACnB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO;AAAA,MACb,cAAc,OAAO;AAAA,IACvB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,yBAAyB,IAAI,IAAI,KAAK;AAC5C,UAAM,uBAAuB,IAAI,IAAI,KAAK;AAC1C,UAAM,oBAAoB,IAAI,IAAI,KAAK;AACvC,UAAM,qCAAqC,IAAI,IAAI,IAAI,QAAQ;AAC/D,UAAM,8BAA8B,IAAI,EAAE;AAC1C,eAAW,SAAS,6BAA6B;AAC/C,YAAM,sBAAsB,IAAI,IAAI;AAAA,QAClC,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,MAAM;AAAA,QACN,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,MACd,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,qBAAqB,IAAI,IAAI,IAAI,WAAW,KAAK;AAAA,EACzD;AAAA,EAEA,qBAAqB;AAAA,IACnB,OAAO;AAAA,MACL;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customers/subscribers/channel-visibility-changed.js

@@ -0,0 +1,16 @@
+import { invalidatePersonDetailCache } from "../lib/personDetailCacheTags.js";
+const metadata = {
+  event: "communication_channels.channel.visibility_changed",
+  persistent: false,
+  id: "customers:channel-visibility-changed"
+};
+async function handler(payload, ctx) {
+  const tenantId = typeof payload?.tenantId === "string" && payload.tenantId ? payload.tenantId : null;
+  if (!tenantId) return;
+  await invalidatePersonDetailCache(ctx, tenantId, payload?.organizationId ?? null);
+}
+export {
+  handler as default,
+  metadata
+};
+//# sourceMappingURL=channel-visibility-changed.js.map

package/dist/modules/customers/subscribers/channel-visibility-changed.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/subscribers/channel-visibility-changed.ts"],
+  "sourcesContent": ["/**\n * Subscriber for `communication_channels.channel.visibility_changed`.\n *\n * Flipping a whole mailbox between private and shared changes which email rows\n * the person-detail read filter admits, without writing any resource whose\n * collection tags the cached person-detail payload observes \u2014 so nothing else\n * invalidates it. The revoke direction is the one that matters: without this a\n * teammate keeps reading now-private email from their own warm cache entry for\n * the rest of the TTL.\n *\n * The invalidation lives on the CUSTOMERS side because the cache it clears is\n * this module's. `communication_channels` declares `requires: ['progress']` and\n * must not grow a dependency on `customers` to do its own writes \u2014 the hub emits\n * the event with the tenant/organization scope, and whoever cares reacts. Same\n * direction as the two `link-channel-message-*` subscribers.\n *\n * Ephemeral on purpose. Under single-delivery, persistent subscribers run ONLY\n * in the events worker, which would leave the stale entry readable until the\n * queue drains; inline delivery keeps the invalidation on the same path the\n * write already takes, matching the behaviour when the channel route called the\n * helper directly. Cache invalidation is a read-your-writes concern, the same\n * reason `query_index.upsert_one` is ephemeral.\n */\nimport { invalidatePersonDetailCache } from '../lib/personDetailCacheTags'\n\ntype ChannelVisibilityChangedPayload = {\n  tenantId?: string | null\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport const metadata = {\n  event: 'communication_channels.channel.visibility_changed',\n  persistent: false,\n  id: 'customers:channel-visibility-changed',\n}\n\nexport default async function handler(\n  payload: ChannelVisibilityChangedPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  // Fail closed: the cache tags are tenant-scoped, and building them from a null\n  // tenant would clear a tag set that belongs to no one.\n  const tenantId = typeof payload?.tenantId === 'string' && payload.tenantId ? payload.tenantId : null\n  if (!tenantId) return\n  await invalidatePersonDetailCache(ctx, tenantId, payload?.organizationId ?? null)\n}\n"],
+  "mappings": "AAuBA,SAAS,mCAAmC;AAWrC,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,eAAO,QACL,SACA,KACe;AAGf,QAAM,WAAW,OAAO,SAAS,aAAa,YAAY,QAAQ,WAAW,QAAQ,WAAW;AAChG,MAAI,CAAC,SAAU;AACf,QAAM,4BAA4B,KAAK,UAAU,SAAS,kBAAkB,IAAI;AAClF;",
+  "names": []
+}

package/dist/modules/dashboards/api/widgets/data/batch/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import {
   createWidgetDataService,
   WidgetDataValidationError,
@@ -73,13 +74,7 @@ async function POST(req) {
     useContext: true
   });
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationIds = (() => {
-    if (scope?.selectedId) return [scope.selectedId];
-    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds;
-    if (scope?.allowedIds === null) return void 0;
-    if (auth.orgId) return [auth.orgId];
-    return void 0;
-  })();
+  const { organizationIds, rbacOrganizationId } = resolveOrganizationScopeFilter(scope, auth);
   const cache = container.resolve("cache");
   const service = createWidgetDataService(
     em,
@@ -96,7 +91,7 @@ async function POST(req) {
         if (features.length === 0) return Promise.resolve(true);
         return rbacService.userHasAllFeatures(auth.sub, features, {
           tenantId,
-          organizationId: auth.orgId
+          organizationId: rbacOrganizationId
         });
       },
       fetchOne: (request) => service.fetchWidgetData(request),

package/dist/modules/dashboards/api/widgets/data/batch/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/dashboards/api/widgets/data/batch/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  createWidgetDataService,\n  type WidgetDataRequest,\n  WidgetDataValidationError,\n  WidgetDataScanLimitError,\n  WidgetDataEncryptionUnavailableError,\n} from '../../../../services/widgetDataService'\nimport { runWidgetDataBatch } from '../../../../lib/widgetDataBatch'\nimport type { AnalyticsRegistry } from '../../../../services/analyticsRegistry'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema } from '../../../openapi'\nimport { widgetDataRequestSchema, widgetDataResponseSchema } from '../schema'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOptionalBaseCurrencyResolver } from '../../../../lib/optionalBaseCurrency'\n\nconst logger = createLogger('dashboards').child({ component: 'widgets-data-batch' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['analytics.view'] },\n}\n\nconst MAX_BATCH_SIZE = 50\n\nconst widgetDataBatchRequestSchema = z.object({\n  requests: z\n    .array(\n      z.object({\n        id: z.string().min(1),\n        request: widgetDataRequestSchema,\n      }),\n    )\n    .min(1)\n    .max(MAX_BATCH_SIZE),\n})\n\nconst widgetDataBatchResponseSchema = z.object({\n  results: z.array(\n    z.discriminatedUnion('ok', [\n      z.object({\n        id: z.string(),\n        ok: z.literal(true),\n        data: widgetDataResponseSchema,\n      }),\n      z.object({\n        id: z.string(),\n        ok: z.literal(false),\n        error: z.string(),\n      }),\n    ]),\n  ),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const parsed = widgetDataBatchRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid request payload', issues: parsed.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const tenantId = auth.tenantId ?? null\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  // Build the per-request DI/RBAC/org-scope stack exactly once for the whole\n  // batch instead of once per widget (see issue #2273).\n  const container = await createRequestContainer()\n  const analyticsRegistry = container.resolve<AnalyticsRegistry>('analyticsRegistry')\n\n  const em = (container.resolve('em') as EntityManager).fork({\n    clear: true,\n    freshEventManager: true,\n    useContext: true,\n  })\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const organizationIds = (() => {\n    if (scope?.selectedId) return [scope.selectedId]\n    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds\n    if (scope?.allowedIds === null) return undefined\n    if (auth.orgId) return [auth.orgId]\n    return undefined\n  })()\n\n  const cache = container.resolve<CacheStrategy>('cache')\n  const service = createWidgetDataService(\n    em,\n    { tenantId, organizationIds },\n    analyticsRegistry,\n    cache,\n    resolveOptionalBaseCurrencyResolver(container),\n  )\n\n  const rbacService = container.resolve<{\n    userHasAllFeatures: (\n      userId: string,\n      features: string[],\n      scope: { tenantId: string; organizationId?: string | null },\n    ) => Promise<boolean>\n  }>('rbacService')\n\n  try {\n    const results = await runWidgetDataBatch(parsed.data.requests as Array<{ id: string; request: WidgetDataRequest }>, {\n      getRequiredFeatures: (entityType) => analyticsRegistry.getRequiredFeatures(entityType),\n      checkFeatures: (features) => {\n        if (features.length === 0) return Promise.resolve(true)\n        return rbacService.userHasAllFeatures(auth.sub, features, {\n          tenantId,\n          organizationId: auth.orgId,\n        })\n      },\n      fetchOne: (request) => service.fetchWidgetData(request),\n      describeError: (error) =>\n        error instanceof WidgetDataValidationError\n        || error instanceof WidgetDataScanLimitError\n        || error instanceof WidgetDataEncryptionUnavailableError\n          ? error.message\n          : 'An error occurred while processing your request',\n    })\n    return NextResponse.json({ results })\n  } catch (err) {\n    logger.error('Widget batch data request failed', { err })\n    return NextResponse.json(\n      { error: 'An error occurred while processing your request' },\n      { status: 500 },\n    )\n  }\n}\n\nconst widgetDataBatchPostDoc: OpenApiMethodDoc = {\n  summary: 'Fetch aggregated data for multiple dashboard widgets in one request',\n  description:\n    'Resolves a batch of widget data requests with a single authentication, RBAC, organization-scope, and database-context setup. Each request is keyed by an opaque widget id and resolved independently, so a failure in one widget does not fail the batch.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: widgetDataBatchRequestSchema,\n    description: 'A list of id-keyed widget data requests to resolve together.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Per-widget aggregation results keyed by request id.',\n      schema: widgetDataBatchResponseSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Batch widget data aggregation endpoint',\n  methods: {\n    POST: widgetDataBatchPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAGnC,SAAS,eAAe,6BAA6B;AACrD,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAE5E,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,iBAAiB;AAEvB,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,UAAU,EACP;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACpB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,IAAI,CAAC,EACL,IAAI,cAAc;AACvB,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,SAAS,EAAE;AAAA,IACT,EAAE,mBAAmB,MAAM;AAAA,MACzB,EAAE,OAAO;AAAA,QACP,IAAI,EAAE,OAAO;AAAA,QACb,IAAI,EAAE,QAAQ,IAAI;AAAA,QAClB,MAAM;AAAA,MACR,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,IAAI,EAAE,OAAO;AAAA,QACb,IAAI,EAAE,QAAQ,KAAK;AAAA,QACnB,OAAO,EAAE,OAAO;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B,QAAQ,OAAO,MAAM,OAAO;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAIA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,UAAU,QAA2B,mBAAmB;AAElF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACzD,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,mBAAmB,MAAM;AAC7B,QAAI,OAAO,WAAY,QAAO,CAAC,MAAM,UAAU;AAC/C,QAAI,MAAM,QAAQ,OAAO,SAAS,KAAK,MAAM,UAAU,SAAS,EAAG,QAAO,MAAM;AAChF,QAAI,OAAO,eAAe,KAAM,QAAO;AACvC,QAAI,KAAK,MAAO,QAAO,CAAC,KAAK,KAAK;AAClC,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,QAAQ,UAAU,QAAuB,OAAO;AACtD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,EAAE,UAAU,gBAAgB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,oCAAoC,SAAS;AAAA,EAC/C;AAEA,QAAM,cAAc,UAAU,QAM3B,aAAa;AAEhB,MAAI;AACF,UAAM,UAAU,MAAM,mBAAmB,OAAO,KAAK,UAA+D;AAAA,MAClH,qBAAqB,CAAC,eAAe,kBAAkB,oBAAoB,UAAU;AAAA,MACrF,eAAe,CAAC,aAAa;AAC3B,YAAI,SAAS,WAAW,EAAG,QAAO,QAAQ,QAAQ,IAAI;AACtD,eAAO,YAAY,mBAAmB,KAAK,KAAK,UAAU;AAAA,UACxD;AAAA,UACA,gBAAgB,KAAK;AAAA,QACvB,CAAC;AAAA,MACH;AAAA,MACA,UAAU,CAAC,YAAY,QAAQ,gBAAgB,OAAO;AAAA,MACtD,eAAe,CAAC,UACd,iBAAiB,6BACd,iBAAiB,4BACjB,iBAAiB,uCAChB,MAAM,UACN;AAAA,IACR,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,KAAK;AACZ,WAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kDAAkD;AAAA,MAC3D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAA2C;AAAA,EAC/C,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,EACrF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport {\n  createWidgetDataService,\n  type WidgetDataRequest,\n  WidgetDataValidationError,\n  WidgetDataScanLimitError,\n  WidgetDataEncryptionUnavailableError,\n} from '../../../../services/widgetDataService'\nimport { runWidgetDataBatch } from '../../../../lib/widgetDataBatch'\nimport type { AnalyticsRegistry } from '../../../../services/analyticsRegistry'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema } from '../../../openapi'\nimport { widgetDataRequestSchema, widgetDataResponseSchema } from '../schema'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOptionalBaseCurrencyResolver } from '../../../../lib/optionalBaseCurrency'\n\nconst logger = createLogger('dashboards').child({ component: 'widgets-data-batch' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['analytics.view'] },\n}\n\nconst MAX_BATCH_SIZE = 50\n\nconst widgetDataBatchRequestSchema = z.object({\n  requests: z\n    .array(\n      z.object({\n        id: z.string().min(1),\n        request: widgetDataRequestSchema,\n      }),\n    )\n    .min(1)\n    .max(MAX_BATCH_SIZE),\n})\n\nconst widgetDataBatchResponseSchema = z.object({\n  results: z.array(\n    z.discriminatedUnion('ok', [\n      z.object({\n        id: z.string(),\n        ok: z.literal(true),\n        data: widgetDataResponseSchema,\n      }),\n      z.object({\n        id: z.string(),\n        ok: z.literal(false),\n        error: z.string(),\n      }),\n    ]),\n  ),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const parsed = widgetDataBatchRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid request payload', issues: parsed.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const tenantId = auth.tenantId ?? null\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  // Build the per-request DI/RBAC/org-scope stack exactly once for the whole\n  // batch instead of once per widget (see issue #2273).\n  const container = await createRequestContainer()\n  const analyticsRegistry = container.resolve<AnalyticsRegistry>('analyticsRegistry')\n\n  const em = (container.resolve('em') as EntityManager).fork({\n    clear: true,\n    freshEventManager: true,\n    useContext: true,\n  })\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const { organizationIds, rbacOrganizationId } = resolveOrganizationScopeFilter(scope, auth)\n\n  const cache = container.resolve<CacheStrategy>('cache')\n  const service = createWidgetDataService(\n    em,\n    { tenantId, organizationIds },\n    analyticsRegistry,\n    cache,\n    resolveOptionalBaseCurrencyResolver(container),\n  )\n\n  const rbacService = container.resolve<{\n    userHasAllFeatures: (\n      userId: string,\n      features: string[],\n      scope: { tenantId: string; organizationId?: string | null },\n    ) => Promise<boolean>\n  }>('rbacService')\n\n  try {\n    const results = await runWidgetDataBatch(parsed.data.requests as Array<{ id: string; request: WidgetDataRequest }>, {\n      getRequiredFeatures: (entityType) => analyticsRegistry.getRequiredFeatures(entityType),\n      checkFeatures: (features) => {\n        if (features.length === 0) return Promise.resolve(true)\n        return rbacService.userHasAllFeatures(auth.sub, features, {\n          tenantId,\n          organizationId: rbacOrganizationId,\n        })\n      },\n      fetchOne: (request) => service.fetchWidgetData(request),\n      describeError: (error) =>\n        error instanceof WidgetDataValidationError\n        || error instanceof WidgetDataScanLimitError\n        || error instanceof WidgetDataEncryptionUnavailableError\n          ? error.message\n          : 'An error occurred while processing your request',\n    })\n    return NextResponse.json({ results })\n  } catch (err) {\n    logger.error('Widget batch data request failed', { err })\n    return NextResponse.json(\n      { error: 'An error occurred while processing your request' },\n      { status: 500 },\n    )\n  }\n}\n\nconst widgetDataBatchPostDoc: OpenApiMethodDoc = {\n  summary: 'Fetch aggregated data for multiple dashboard widgets in one request',\n  description:\n    'Resolves a batch of widget data requests with a single authentication, RBAC, organization-scope, and database-context setup. Each request is keyed by an opaque widget id and resolved independently, so a failure in one widget does not fail the batch.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: widgetDataBatchRequestSchema,\n    description: 'A list of id-keyed widget data requests to resolve together.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Per-widget aggregation results keyed by request id.',\n      schema: widgetDataBatchResponseSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Batch widget data aggregation endpoint',\n  methods: {\n    POST: widgetDataBatchPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAGnC,SAAS,eAAe,6BAA6B;AACrD,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAE5E,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,iBAAiB;AAEvB,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,UAAU,EACP;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACpB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,EACC,IAAI,CAAC,EACL,IAAI,cAAc;AACvB,CAAC;AAED,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,SAAS,EAAE;AAAA,IACT,EAAE,mBAAmB,MAAM;AAAA,MACzB,EAAE,OAAO;AAAA,QACP,IAAI,EAAE,OAAO;AAAA,QACb,IAAI,EAAE,QAAQ,IAAI;AAAA,QAClB,MAAM;AAAA,MACR,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,IAAI,EAAE,OAAO;AAAA,QACb,IAAI,EAAE,QAAQ,KAAK;AAAA,QACnB,OAAO,EAAE,OAAO;AAAA,MAClB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AACF,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B,QAAQ,OAAO,MAAM,OAAO;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAIA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,UAAU,QAA2B,mBAAmB;AAElF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACzD,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,EAAE,iBAAiB,mBAAmB,IAAI,+BAA+B,OAAO,IAAI;AAE1F,QAAM,QAAQ,UAAU,QAAuB,OAAO;AACtD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,EAAE,UAAU,gBAAgB;AAAA,IAC5B;AAAA,IACA;AAAA,IACA,oCAAoC,SAAS;AAAA,EAC/C;AAEA,QAAM,cAAc,UAAU,QAM3B,aAAa;AAEhB,MAAI;AACF,UAAM,UAAU,MAAM,mBAAmB,OAAO,KAAK,UAA+D;AAAA,MAClH,qBAAqB,CAAC,eAAe,kBAAkB,oBAAoB,UAAU;AAAA,MACrF,eAAe,CAAC,aAAa;AAC3B,YAAI,SAAS,WAAW,EAAG,QAAO,QAAQ,QAAQ,IAAI;AACtD,eAAO,YAAY,mBAAmB,KAAK,KAAK,UAAU;AAAA,UACxD;AAAA,UACA,gBAAgB;AAAA,QAClB,CAAC;AAAA,MACH;AAAA,MACA,UAAU,CAAC,YAAY,QAAQ,gBAAgB,OAAO;AAAA,MACtD,eAAe,CAAC,UACd,iBAAiB,6BACd,iBAAiB,4BACjB,iBAAiB,uCAChB,MAAM,UACN;AAAA,IACR,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,EACtC,SAAS,KAAK;AACZ,WAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kDAAkD;AAAA,MAC3D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAA2C;AAAA,EAC/C,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,EACrF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/dashboards/api/widgets/data/route.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import {
   createWidgetDataService,
   WidgetDataValidationError,
@@ -37,12 +38,18 @@ async function POST(req) {
   }
   const container = await createRequestContainer();
   const analyticsRegistry = container.resolve("analyticsRegistry");
+  const tenantId = auth.tenantId ?? null;
+  if (!tenantId) {
+    return NextResponse.json({ error: "Tenant context is required" }, { status: 400 });
+  }
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+  const { organizationIds, rbacOrganizationId } = resolveOrganizationScopeFilter(scope, auth);
   const entityFeatures = analyticsRegistry.getRequiredFeatures(parsed.data.entityType);
   if (entityFeatures && entityFeatures.length > 0) {
     const rbacService = container.resolve("rbacService");
     const hasAccess = await rbacService.userHasAllFeatures(auth.sub, entityFeatures, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId
+      tenantId,
+      organizationId: rbacOrganizationId
     });
     if (!hasAccess) {
       return NextResponse.json({ error: "Forbidden" }, { status: 403 });
@@ -53,18 +60,6 @@ async function POST(req) {
     freshEventManager: true,
     useContext: true
   });
-  const tenantId = auth.tenantId ?? null;
-  if (!tenantId) {
-    return NextResponse.json({ error: "Tenant context is required" }, { status: 400 });
-  }
-  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationIds = (() => {
-    if (scope?.selectedId) return [scope.selectedId];
-    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds;
-    if (scope?.allowedIds === null) return void 0;
-    if (auth.orgId) return [auth.orgId];
-    return void 0;
-  })();
   const userFeatures = Array.isArray(auth.features) ? auth.features.filter((value) => typeof value === "string") : [];
   const headers = {};
   req.headers.forEach((value, key) => {
@@ -84,7 +79,7 @@ async function POST(req) {
       container,
       userId: auth.sub ?? "",
       tenantId,
-      organizationId: organizationIds?.[0] ?? auth.orgId ?? "",
+      organizationId: rbacOrganizationId ?? "",
       userFeatures
     }
   });

package/dist/modules/dashboards/api/widgets/data/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dashboards/api/widgets/data/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport {\n  createWidgetDataService,\n  type WidgetDataRequest,\n  WidgetDataValidationError,\n  WidgetDataScanLimitError,\n  WidgetDataEncryptionUnavailableError,\n} from '../../../services/widgetDataService'\nimport type { AnalyticsRegistry } from '../../../services/analyticsRegistry'\nimport { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema } from '../../openapi'\nimport { widgetDataRequestSchema, widgetDataResponseSchema } from './schema'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOptionalBaseCurrencyResolver } from '../../../lib/optionalBaseCurrency'\n\nconst logger = createLogger('dashboards').child({ component: 'widgets-data' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['analytics.view'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const parsed = widgetDataRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid request payload', issues: parsed.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const analyticsRegistry = container.resolve<AnalyticsRegistry>('analyticsRegistry')\n\n  const entityFeatures = analyticsRegistry.getRequiredFeatures(parsed.data.entityType)\n  if (entityFeatures && entityFeatures.length > 0) {\n    const rbacService = container.resolve<{\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string; organizationId?: string | null },\n      ) => Promise<boolean>\n    }>('rbacService')\n    const hasAccess = await rbacService.userHasAllFeatures(auth.sub, entityFeatures, {\n      tenantId: auth.tenantId!,\n      organizationId: auth.orgId,\n    })\n    if (!hasAccess) {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork({\n    clear: true,\n    freshEventManager: true,\n    useContext: true,\n  })\n\n  const tenantId = auth.tenantId ?? null\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const organizationIds = (() => {\n    if (scope?.selectedId) return [scope.selectedId]\n    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds\n    if (scope?.allowedIds === null) return undefined\n    if (auth.orgId) return [auth.orgId]\n    return undefined\n  })()\n\n  const userFeatures = Array.isArray(auth.features)\n    ? auth.features.filter((value): value is string => typeof value === 'string')\n    : []\n\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const interceptorResult = await runApiInterceptorsBefore({\n    routePath: 'dashboards/widgets/data',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      headers,\n      body: parsed.data as unknown as Record<string, unknown>,\n    },\n    context: {\n      em,\n      container,\n      userId: auth.sub ?? '',\n      tenantId,\n      organizationId: organizationIds?.[0] ?? auth.orgId ?? '',\n      userFeatures,\n    },\n  })\n\n  if (!interceptorResult.ok) {\n    return NextResponse.json(interceptorResult.body, { status: interceptorResult.statusCode })\n  }\n\n  const requestData = (interceptorResult.request.body ?? parsed.data) as WidgetDataRequest\n\n  try {\n    const cache = container.resolve<CacheStrategy>('cache')\n    const service = createWidgetDataService(\n      em,\n      { tenantId, organizationIds },\n      analyticsRegistry,\n      cache,\n      resolveOptionalBaseCurrencyResolver(container),\n    )\n    const result = await service.fetchWidgetData(requestData)\n    return NextResponse.json(result)\n  } catch (err) {\n    logger.error('Widget data request failed', { err })\n    if (err instanceof WidgetDataValidationError) {\n      return NextResponse.json({ error: err.message }, { status: 400 })\n    }\n    // The dataset is too large to group in application code; surface why rather than a masked 500.\n    if (err instanceof WidgetDataScanLimitError) {\n      return NextResponse.json({ error: err.message }, { status: 422 })\n    }\n    // Encryption is configured but currently unresolvable. Refusing the request keeps ciphertext and\n    // silently-wrong buckets out of the response, and 503 tells the client it is worth retrying.\n    if (err instanceof WidgetDataEncryptionUnavailableError) {\n      return NextResponse.json({ error: err.message }, { status: 503 })\n    }\n    return NextResponse.json(\n      { error: 'An error occurred while processing your request' },\n      { status: 500 },\n    )\n  }\n}\n\nconst widgetDataPostDoc: OpenApiMethodDoc = {\n  summary: 'Fetch aggregated data for dashboard widgets',\n  description:\n    'Executes an aggregation query against the specified entity type and returns the result. Supports date range filtering, grouping, and period-over-period comparison.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: widgetDataRequestSchema,\n    description: 'Widget data request configuration specifying entity type, metric, filters, and grouping.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Aggregated data for the widget.',\n      schema: widgetDataResponseSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    {\n      status: 422,\n      description: 'Too many rows to group an encrypted field in application code',\n      schema: dashboardsErrorSchema,\n    },\n    { status: 403, description: 'Missing analytics.view feature', schema: dashboardsErrorSchema },\n    { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },\n    {\n      status: 503,\n      description: 'Encryption is configured but the group source cannot currently be resolved',\n      schema: dashboardsErrorSchema,\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Widget data aggregation endpoint',\n  methods: {\n    POST: widgetDataPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,gCAAgC;AAEzC,SAAS,eAAe,6BAA6B;AACrD,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEtE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B,QAAQ,OAAO,MAAM,OAAO;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,UAAU,QAA2B,mBAAmB;AAElF,QAAM,iBAAiB,kBAAkB,oBAAoB,OAAO,KAAK,UAAU;AACnF,MAAI,kBAAkB,eAAe,SAAS,GAAG;AAC/C,UAAM,cAAc,UAAU,QAM3B,aAAa;AAChB,UAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,gBAAgB;AAAA,MAC/E,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACzD,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,mBAAmB,MAAM;AAC7B,QAAI,OAAO,WAAY,QAAO,CAAC,MAAM,UAAU;AAC/C,QAAI,MAAM,QAAQ,OAAO,SAAS,KAAK,MAAM,UAAU,SAAS,EAAG,QAAO,MAAM;AAChF,QAAI,OAAO,eAAe,KAAM,QAAO;AACvC,QAAI,KAAK,MAAO,QAAO,CAAC,KAAK,KAAK;AAClC,WAAO;AAAA,EACT,GAAG;AAEH,QAAM,eAAe,MAAM,QAAQ,KAAK,QAAQ,IAC5C,KAAK,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC1E,CAAC;AAEL,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT;AAAA,MACA,MAAM,OAAO;AAAA,IACf;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA,gBAAgB,kBAAkB,CAAC,KAAK,KAAK,SAAS;AAAA,MACtD;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,CAAC,kBAAkB,IAAI;AACzB,WAAO,aAAa,KAAK,kBAAkB,MAAM,EAAE,QAAQ,kBAAkB,WAAW,CAAC;AAAA,EAC3F;AAEA,QAAM,cAAe,kBAAkB,QAAQ,QAAQ,OAAO;AAE9D,MAAI;AACF,UAAM,QAAQ,UAAU,QAAuB,OAAO;AACtD,UAAM,UAAU;AAAA,MACd;AAAA,MACA,EAAE,UAAU,gBAAgB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,oCAAoC,SAAS;AAAA,IAC/C;AACA,UAAM,SAAS,MAAM,QAAQ,gBAAgB,WAAW;AACxD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,QAAI,eAAe,2BAA2B;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAGA,QAAI,eAAe,sCAAsC;AACvD,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kDAAkD;AAAA,MAC3D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,sBAAsB;AAAA,IAC5F,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,IACnF;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport {\n  createWidgetDataService,\n  type WidgetDataRequest,\n  WidgetDataValidationError,\n  WidgetDataScanLimitError,\n  WidgetDataEncryptionUnavailableError,\n} from '../../../services/widgetDataService'\nimport type { AnalyticsRegistry } from '../../../services/analyticsRegistry'\nimport { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema } from '../../openapi'\nimport { widgetDataRequestSchema, widgetDataResponseSchema } from './schema'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOptionalBaseCurrencyResolver } from '../../../lib/optionalBaseCurrency'\n\nconst logger = createLogger('dashboards').child({ component: 'widgets-data' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['analytics.view'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n\n  const parsed = widgetDataRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'Invalid request payload', issues: parsed.error.issues },\n      { status: 400 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const analyticsRegistry = container.resolve<AnalyticsRegistry>('analyticsRegistry')\n\n  const tenantId = auth.tenantId ?? null\n  if (!tenantId) {\n    return NextResponse.json({ error: 'Tenant context is required' }, { status: 400 })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const { organizationIds, rbacOrganizationId } = resolveOrganizationScopeFilter(scope, auth)\n\n  const entityFeatures = analyticsRegistry.getRequiredFeatures(parsed.data.entityType)\n  if (entityFeatures && entityFeatures.length > 0) {\n    const rbacService = container.resolve<{\n      userHasAllFeatures: (\n        userId: string,\n        features: string[],\n        scope: { tenantId: string; organizationId?: string | null },\n      ) => Promise<boolean>\n    }>('rbacService')\n    const hasAccess = await rbacService.userHasAllFeatures(auth.sub, entityFeatures, {\n      tenantId,\n      organizationId: rbacOrganizationId,\n    })\n    if (!hasAccess) {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork({\n    clear: true,\n    freshEventManager: true,\n    useContext: true,\n  })\n\n  const userFeatures = Array.isArray(auth.features)\n    ? auth.features.filter((value): value is string => typeof value === 'string')\n    : []\n\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const interceptorResult = await runApiInterceptorsBefore({\n    routePath: 'dashboards/widgets/data',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      headers,\n      body: parsed.data as unknown as Record<string, unknown>,\n    },\n    context: {\n      em,\n      container,\n      userId: auth.sub ?? '',\n      tenantId,\n      organizationId: rbacOrganizationId ?? '',\n      userFeatures,\n    },\n  })\n\n  if (!interceptorResult.ok) {\n    return NextResponse.json(interceptorResult.body, { status: interceptorResult.statusCode })\n  }\n\n  const requestData = (interceptorResult.request.body ?? parsed.data) as WidgetDataRequest\n\n  try {\n    const cache = container.resolve<CacheStrategy>('cache')\n    const service = createWidgetDataService(\n      em,\n      { tenantId, organizationIds },\n      analyticsRegistry,\n      cache,\n      resolveOptionalBaseCurrencyResolver(container),\n    )\n    const result = await service.fetchWidgetData(requestData)\n    return NextResponse.json(result)\n  } catch (err) {\n    logger.error('Widget data request failed', { err })\n    if (err instanceof WidgetDataValidationError) {\n      return NextResponse.json({ error: err.message }, { status: 400 })\n    }\n    // The dataset is too large to group in application code; surface why rather than a masked 500.\n    if (err instanceof WidgetDataScanLimitError) {\n      return NextResponse.json({ error: err.message }, { status: 422 })\n    }\n    // Encryption is configured but currently unresolvable. Refusing the request keeps ciphertext and\n    // silently-wrong buckets out of the response, and 503 tells the client it is worth retrying.\n    if (err instanceof WidgetDataEncryptionUnavailableError) {\n      return NextResponse.json({ error: err.message }, { status: 503 })\n    }\n    return NextResponse.json(\n      { error: 'An error occurred while processing your request' },\n      { status: 500 },\n    )\n  }\n}\n\nconst widgetDataPostDoc: OpenApiMethodDoc = {\n  summary: 'Fetch aggregated data for dashboard widgets',\n  description:\n    'Executes an aggregation query against the specified entity type and returns the result. Supports date range filtering, grouping, and period-over-period comparison.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: widgetDataRequestSchema,\n    description: 'Widget data request configuration specifying entity type, metric, filters, and grouping.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Aggregated data for the widget.',\n      schema: widgetDataResponseSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    {\n      status: 422,\n      description: 'Too many rows to group an encrypted field in application code',\n      schema: dashboardsErrorSchema,\n    },\n    { status: 403, description: 'Missing analytics.view feature', schema: dashboardsErrorSchema },\n    { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },\n    {\n      status: 503,\n      description: 'Encryption is configured but the group source cannot currently be resolved',\n      schema: dashboardsErrorSchema,\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Widget data aggregation endpoint',\n  methods: {\n    POST: widgetDataPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,gCAAgC;AAEzC,SAAS,eAAe,6BAA6B;AACrD,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,oBAAoB;AAC7B,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAEtE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2BAA2B,QAAQ,OAAO,MAAM,OAAO;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,oBAAoB,UAAU,QAA2B,mBAAmB;AAElF,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,EAAE,iBAAiB,mBAAmB,IAAI,+BAA+B,OAAO,IAAI;AAE1F,QAAM,iBAAiB,kBAAkB,oBAAoB,OAAO,KAAK,UAAU;AACnF,MAAI,kBAAkB,eAAe,SAAS,GAAG;AAC/C,UAAM,cAAc,UAAU,QAM3B,aAAa;AAChB,UAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,gBAAgB;AAAA,MAC/E;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,WAAW;AACd,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACzD,OAAO;AAAA,IACP,mBAAmB;AAAA,IACnB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,eAAe,MAAM,QAAQ,KAAK,QAAQ,IAC5C,KAAK,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC1E,CAAC;AAEL,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,oBAAoB,MAAM,yBAAyB;AAAA,IACvD,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT;AAAA,MACA,MAAM,OAAO;AAAA,IACf;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB;AAAA,MACA,gBAAgB,sBAAsB;AAAA,MACtC;AAAA,IACF;AAAA,EACF,CAAC;AAED,MAAI,CAAC,kBAAkB,IAAI;AACzB,WAAO,aAAa,KAAK,kBAAkB,MAAM,EAAE,QAAQ,kBAAkB,WAAW,CAAC;AAAA,EAC3F;AAEA,QAAM,cAAe,kBAAkB,QAAQ,QAAQ,OAAO;AAE9D,MAAI;AACF,UAAM,QAAQ,UAAU,QAAuB,OAAO;AACtD,UAAM,UAAU;AAAA,MACd;AAAA,MACA,EAAE,UAAU,gBAAgB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,oCAAoC,SAAS;AAAA,IAC/C;AACA,UAAM,SAAS,MAAM,QAAQ,gBAAgB,WAAW;AACxD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,KAAK;AACZ,WAAO,MAAM,8BAA8B,EAAE,IAAI,CAAC;AAClD,QAAI,eAAe,2BAA2B;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAEA,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAGA,QAAI,eAAe,sCAAsC;AACvD,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,kDAAkD;AAAA,MAC3D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,sBAAsB;AAAA,IAC5F,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,IACnF;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/dashboards/lib/aggregations.js

@@ -84,7 +84,7 @@ function buildWhereClause(options) {
   const whereClauses = [];
   whereClauses.push(`tenant_id = ?`);
   params.push(options.scope.tenantId);
-  if (options.scope.organizationIds && options.scope.organizationIds.length > 0) {
+  if (options.scope.organizationIds !== void 0) {
     whereClauses.push(`organization_id = ANY(?::uuid[])`);
     params.push(`{${options.scope.organizationIds.join(",")}}`);
   }

package/dist/modules/dashboards/lib/aggregations.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dashboards/lib/aggregations.ts"],
-  "sourcesContent": ["import type { AnalyticsRegistry } from '../services/analyticsRegistry'\nimport type { AnalyticsEntityTypeConfig, AnalyticsFieldMapping } from '@open-mercato/shared/modules/analytics'\n\nexport type AggregateFunction = 'count' | 'sum' | 'avg' | 'min' | 'max'\nexport type DateGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year'\n\nconst VALID_GRANULARITIES: readonly DateGranularity[] = ['day', 'week', 'month', 'quarter', 'year']\nconst VALID_AGGREGATES: readonly AggregateFunction[] = ['count', 'sum', 'avg', 'min', 'max']\nconst SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/\n\nexport function isValidGranularity(value: unknown): value is DateGranularity {\n  return typeof value === 'string' && VALID_GRANULARITIES.includes(value as DateGranularity)\n}\n\nexport function isValidAggregate(value: unknown): value is AggregateFunction {\n  return typeof value === 'string' && VALID_AGGREGATES.includes(value as AggregateFunction)\n}\n\nfunction isSafeIdentifier(value: string): boolean {\n  return SAFE_IDENTIFIER_PATTERN.test(value)\n}\n\n// Re-export types from shared module for convenience\nexport type EntityTypeConfig = AnalyticsEntityTypeConfig\nexport type FieldMapping = AnalyticsFieldMapping\n\nexport function buildAggregateExpression(aggregate: AggregateFunction, column: string): string {\n  switch (aggregate) {\n    case 'count':\n      return column === 'id' ? 'COUNT(*)' : `COUNT(${column})`\n    case 'sum':\n      return `COALESCE(SUM(${column}::numeric), 0)`\n    case 'avg':\n      return `COALESCE(AVG(${column}::numeric), 0)`\n    case 'min':\n      return `MIN(${column}::numeric)`\n    case 'max':\n      return `MAX(${column}::numeric)`\n    default:\n      return `COUNT(*)`\n  }\n}\n\nexport function buildDateTruncExpression(column: string, granularity: DateGranularity): string {\n  if (!isValidGranularity(granularity)) {\n    throw new Error(`Invalid granularity: ${granularity}`)\n  }\n  return `DATE_TRUNC('${granularity}', ${column})`\n}\n\nexport function buildJsonbFieldExpression(column: string, path: string): string {\n  const parts = path.split('.')\n  for (const part of parts) {\n    if (!isSafeIdentifier(part)) {\n      throw new Error(`Invalid JSONB path part: ${part}`)\n    }\n  }\n  if (parts.length === 1) {\n    return `${column}->>'${parts[0]}'`\n  }\n  const intermediate = parts.slice(0, -1).map((p) => `'${p}'`).join('->')\n  const lastPart = parts[parts.length - 1]\n  return `${column}->${intermediate}->>'${lastPart}'`\n}\n\nexport type AggregationQuery = {\n  sql: string\n  params: unknown[]\n}\n\nexport type BuildAggregationQueryOptions = {\n  entityType: string\n  metric: {\n    field: string\n    aggregate: AggregateFunction\n  }\n  groupBy?: {\n    field: string\n    granularity?: DateGranularity\n    limit?: number\n  }\n  dateRange?: {\n    field: string\n    start: Date\n    end: Date\n  }\n  filters?: Array<{\n    field: string\n    operator: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'is_null' | 'is_not_null'\n    value?: unknown\n  }>\n  scope: {\n    tenantId: string\n    organizationIds?: string[]\n  }\n  /** Analytics registry for resolving entity and field configurations */\n  registry: AnalyticsRegistry\n}\n\nexport type ResolvedGroupExpression = {\n  expression: string\n  /** Column the group expression reads from \u2014 the encryption map is keyed by this. */\n  dbColumn: string\n  /** JSONB path below `dbColumn`, when the groupBy field used path notation. */\n  jsonPath: string | null\n}\n\n/**\n * Resolves the SQL expression a groupBy field maps to, together with the underlying column so\n * callers can decide whether the source is encrypted at rest before grouping over it (#4622).\n */\nexport function resolveGroupExpression(\n  registry: AnalyticsRegistry,\n  entityType: string,\n  groupBy: { field: string; granularity?: DateGranularity },\n): ResolvedGroupExpression | null {\n  const groupMapping = registry.getFieldMapping(entityType, groupBy.field)\n\n  // Handle JSONB path notation (e.g., shippingAddressSnapshot.region)\n  if (!groupMapping && groupBy.field.includes('.')) {\n    const [baseField, ...pathParts] = groupBy.field.split('.')\n    const baseMapping = registry.getFieldMapping(entityType, baseField)\n    if (baseMapping?.type !== 'jsonb') return null\n    const jsonPath = pathParts.join('.')\n    return {\n      expression: buildJsonbFieldExpression(baseMapping.dbColumn, jsonPath),\n      dbColumn: baseMapping.dbColumn,\n      jsonPath,\n    }\n  }\n\n  if (!groupMapping) return null\n\n  if (groupMapping.type === 'timestamp' && groupBy.granularity) {\n    return {\n      expression: buildDateTruncExpression(groupMapping.dbColumn, groupBy.granularity),\n      dbColumn: groupMapping.dbColumn,\n      jsonPath: null,\n    }\n  }\n\n  return { expression: groupMapping.dbColumn, dbColumn: groupMapping.dbColumn, jsonPath: null }\n}\n\n/**\n * Normalizes the value of a set filter (`in` / `not_in`) into the list of members it selects.\n *\n * The list is rendered as one placeholder per member rather than as a single array parameter:\n * MikroORM does not bind parameters at the driver level \u2014 `AbstractSqlConnection.execute` calls\n * `platform.formatQuery`, which interpolates each value through `BasePostgreSqlPlatform.escape`,\n * and that renders a JavaScript array as a bare comma-separated list. The previous\n * `= ANY(?)` / `!= ALL(?)` form therefore produced `= ANY('a', 'b')`, which PostgreSQL rejects\n * for every shape of value (#4669).\n *\n * A missing value yields an empty set rather than a dropped filter, so an `in` filter the caller\n * failed to populate selects nothing instead of silently widening the result.\n *\n * A null or undefined *member* is refused instead of rendered. `column IN (NULL)` matches no row\n * and `column NOT IN ('a', NULL)` is NULL for every row, so such a member would return an empty\n * aggregation with no error \u2014 a silent zero on a reporting surface, which is worse than a loud\n * failure. Requests are already rejected at the API boundary by `widgetDataFilterSchema` in\n * `api/widgets/data/schema.ts`; this throw keeps in-process callers, whose filter values are\n * typed as `unknown`, from reaching the same silent path. Nullness is queried with the dedicated\n * `is_null` / `is_not_null` operators.\n */\nfunction normalizeSetFilterValues(value: unknown): unknown[] {\n  const values = Array.isArray(value) ? value : value === undefined ? [] : [value]\n  if (values.some((member) => member === null || member === undefined)) {\n    throw new Error(\n      '[internal] Set filter members must not be null or undefined \u2014 use the is_null / is_not_null operators to filter on nullness',\n    )\n  }\n  return values\n}\n\n/**\n * Builds the shared WHERE clause every aggregation query reads from, together with its parameters.\n *\n * The `eq` / `neq` cases branch on a null value instead of binding it (#5016). Under SQL\n * three-valued logic neither `column = NULL` nor `column != NULL` is ever `TRUE`, so binding a raw\n * null selected zero rows and rendered as a legitimate-looking empty aggregation \u2014 a silent zero on\n * a reporting surface. Nullness has to be asked with the `IS NULL` / `IS NOT NULL` keywords, which\n * take no parameter; that is also what the dedicated `is_null` / `is_not_null` operators emit, and\n * it mirrors how the query index builds column filters (`query_index/lib/engine.ts`).\n *\n * The ordering operators (`gt`/`gte`/`lt`/`lte`) deliberately keep binding the value: comparing an\n * ordering against NULL is genuinely undefined rather than a mistake, so their never-`TRUE` result\n * is the correct answer. Set operators refuse null members outright \u2014 see\n * `normalizeSetFilterValues`.\n */\nfunction buildWhereClause(\n  options: Pick<BuildAggregationQueryOptions, 'entityType' | 'dateRange' | 'filters' | 'scope' | 'registry'>,\n): { clause: string; params: unknown[] } {\n  const { registry } = options\n  const params: unknown[] = []\n  const whereClauses: string[] = []\n\n  whereClauses.push(`tenant_id = ?`)\n  params.push(options.scope.tenantId)\n\n  if (options.scope.organizationIds && options.scope.organizationIds.length > 0) {\n    whereClauses.push(`organization_id = ANY(?::uuid[])`)\n    params.push(`{${options.scope.organizationIds.join(',')}}`)\n  }\n\n  whereClauses.push(`deleted_at IS NULL`)\n\n  if (options.dateRange) {\n    const dateMapping = registry.getFieldMapping(options.entityType, options.dateRange.field)\n    if (dateMapping) {\n      whereClauses.push(`${dateMapping.dbColumn} >= ?`)\n      params.push(options.dateRange.start)\n      whereClauses.push(`${dateMapping.dbColumn} <= ?`)\n      params.push(options.dateRange.end)\n    }\n  }\n\n  if (options.filters) {\n    for (const filter of options.filters) {\n      const filterMapping = registry.getFieldMapping(options.entityType, filter.field)\n      if (!filterMapping) continue\n\n      switch (filter.operator) {\n        case 'eq':\n          if (filter.value === null) {\n            whereClauses.push(`${filterMapping.dbColumn} IS NULL`)\n            break\n          }\n          whereClauses.push(`${filterMapping.dbColumn} = ?`)\n          params.push(filter.value)\n          break\n        case 'neq':\n          if (filter.value === null) {\n            whereClauses.push(`${filterMapping.dbColumn} IS NOT NULL`)\n            break\n          }\n          whereClauses.push(`${filterMapping.dbColumn} != ?`)\n          params.push(filter.value)\n          break\n        case 'gt':\n          whereClauses.push(`${filterMapping.dbColumn} > ?`)\n          params.push(filter.value)\n          break\n        case 'gte':\n          whereClauses.push(`${filterMapping.dbColumn} >= ?`)\n          params.push(filter.value)\n          break\n        case 'lt':\n          whereClauses.push(`${filterMapping.dbColumn} < ?`)\n          params.push(filter.value)\n          break\n        case 'lte':\n          whereClauses.push(`${filterMapping.dbColumn} <= ?`)\n          params.push(filter.value)\n          break\n        case 'in':\n        case 'not_in': {\n          const values = normalizeSetFilterValues(filter.value)\n          if (values.length === 0) {\n            whereClauses.push(filter.operator === 'in' ? 'FALSE' : 'TRUE')\n            break\n          }\n          const keyword = filter.operator === 'in' ? 'IN' : 'NOT IN'\n          const placeholders = values.map(() => '?').join(', ')\n          whereClauses.push(`${filterMapping.dbColumn} ${keyword} (${placeholders})`)\n          params.push(...values)\n          break\n        }\n        case 'is_null':\n          whereClauses.push(`${filterMapping.dbColumn} IS NULL`)\n          break\n        case 'is_not_null':\n          whereClauses.push(`${filterMapping.dbColumn} IS NOT NULL`)\n          break\n      }\n    }\n  }\n\n  return { clause: whereClauses.length > 0 ? `WHERE ${whereClauses.join(' AND ')}` : '', params }\n}\n\nfunction resolveTableName(config: EntityTypeConfig): string {\n  return config.schema ? `\"${config.schema}\".\"${config.tableName}\"` : `\"${config.tableName}\"`\n}\n\nexport type BuildDistinctCurrencyQueryOptions = Pick<\n  BuildAggregationQueryOptions,\n  'entityType' | 'dateRange' | 'filters' | 'scope' | 'registry'\n>\n\n/**\n * Builds the query that reads the distinct per-row currencies of the rows an aggregation\n * would sum, over exactly the same tenant/organization scope, date range and filters.\n * Returns `null` when the entity declares no `currencyField`, which means its amounts are\n * not per-row denominated and there is nothing to verify (#4676).\n */\nexport function buildDistinctCurrencyQuery(\n  options: BuildDistinctCurrencyQueryOptions,\n): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config?.currencyField) return null\n\n  const currencyMapping = registry.getFieldMapping(options.entityType, config.currencyField)\n  if (!currencyMapping || !isSafeIdentifier(currencyMapping.dbColumn)) return null\n\n  const where = buildWhereClause(options)\n  const normalizedCurrencyExpression = `UPPER(NULLIF(BTRIM(${currencyMapping.dbColumn}), ''))`\n  const sql = [\n    `SELECT DISTINCT ${normalizedCurrencyExpression} AS code`,\n    `FROM ${resolveTableName(config)}`,\n    where.clause,\n    'LIMIT 2',\n  ]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n\nexport function buildAggregationQuery(options: BuildAggregationQueryOptions): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config) return null\n\n  const metricMapping = registry.getFieldMapping(options.entityType, options.metric.field)\n  if (!metricMapping) return null\n\n  const tableName = resolveTableName(config)\n  const aggregateExpr = buildAggregateExpression(options.metric.aggregate, metricMapping.dbColumn)\n\n  let selectClause = `SELECT ${aggregateExpr} AS value`\n  let groupByClause = ''\n  let orderByClause = ''\n  let limitClause = ''\n\n  if (options.groupBy) {\n    const resolved = resolveGroupExpression(registry, options.entityType, options.groupBy)\n\n    if (resolved) {\n      selectClause = `SELECT ${resolved.expression} AS group_key, ${aggregateExpr} AS value`\n      groupByClause = `GROUP BY ${resolved.expression}`\n      // NULLS LAST is stated explicitly (PostgreSQL defaults DESC to NULLS FIRST) so a group limit\n      // keeps the highest-value buckets instead of the empty ones, and so the application-side\n      // encrypted path can mirror the same ordering (#4622).\n      orderByClause = `ORDER BY value DESC NULLS LAST`\n\n      if (options.groupBy.limit && options.groupBy.limit > 0) {\n        limitClause = `LIMIT ${Math.min(options.groupBy.limit, 100)}`\n      }\n    }\n  }\n\n  const where = buildWhereClause(options)\n\n  const sql = [selectClause, `FROM ${tableName}`, where.clause, groupByClause, orderByClause, limitClause]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n\nexport type BuildGroupSourceRowsQueryOptions = Omit<BuildAggregationQueryOptions, 'groupBy'> & {\n  /** Column holding the (encrypted) group source, resolved via `resolveGroupExpression`. */\n  groupColumn: string\n  /** Hard cap on scanned rows; callers fetch `rowLimit + 1` to detect overflow. */\n  rowLimit: number\n}\n\n/**\n * Builds a per-row query for group sources that cannot be grouped in SQL because the column is\n * encrypted at rest. Returns the raw group source alongside the metric value so the caller can\n * decrypt, then aggregate in application code (#4622).\n */\nexport function buildGroupSourceRowsQuery(options: BuildGroupSourceRowsQueryOptions): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config) return null\n\n  const metricMapping = registry.getFieldMapping(options.entityType, options.metric.field)\n  if (!metricMapping) return null\n\n  if (!isSafeIdentifier(options.groupColumn)) {\n    throw new Error(`Invalid group column: ${options.groupColumn}`)\n  }\n\n  const where = buildWhereClause(options)\n  const sql = [\n    `SELECT ${options.groupColumn} AS group_source, ${metricMapping.dbColumn} AS metric_value`,\n    `FROM ${resolveTableName(config)}`,\n    where.clause,\n    `LIMIT ${Math.max(1, Math.floor(options.rowLimit)) + 1}`,\n  ]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n"],
-  "mappings": "AAMA,MAAM,sBAAkD,CAAC,OAAO,QAAQ,SAAS,WAAW,MAAM;AAClG,MAAM,mBAAiD,CAAC,SAAS,OAAO,OAAO,OAAO,KAAK;AAC3F,MAAM,0BAA0B;AAEzB,SAAS,mBAAmB,OAA0C;AAC3E,SAAO,OAAO,UAAU,YAAY,oBAAoB,SAAS,KAAwB;AAC3F;AAEO,SAAS,iBAAiB,OAA4C;AAC3E,SAAO,OAAO,UAAU,YAAY,iBAAiB,SAAS,KAA0B;AAC1F;AAEA,SAAS,iBAAiB,OAAwB;AAChD,SAAO,wBAAwB,KAAK,KAAK;AAC3C;AAMO,SAAS,yBAAyB,WAA8B,QAAwB;AAC7F,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO,WAAW,OAAO,aAAa,SAAS,MAAM;AAAA,IACvD,KAAK;AACH,aAAO,gBAAgB,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,gBAAgB,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,yBAAyB,QAAgB,aAAsC;AAC7F,MAAI,CAAC,mBAAmB,WAAW,GAAG;AACpC,UAAM,IAAI,MAAM,wBAAwB,WAAW,EAAE;AAAA,EACvD;AACA,SAAO,eAAe,WAAW,MAAM,MAAM;AAC/C;AAEO,SAAS,0BAA0B,QAAgB,MAAsB;AAC9E,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,YAAM,IAAI,MAAM,4BAA4B,IAAI,EAAE;AAAA,IACpD;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,MAAM,OAAO,MAAM,CAAC,CAAC;AAAA,EACjC;AACA,QAAM,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AACtE,QAAM,WAAW,MAAM,MAAM,SAAS,CAAC;AACvC,SAAO,GAAG,MAAM,KAAK,YAAY,OAAO,QAAQ;AAClD;AAgDO,SAAS,uBACd,UACA,YACA,SACgC;AAChC,QAAM,eAAe,SAAS,gBAAgB,YAAY,QAAQ,KAAK;AAGvE,MAAI,CAAC,gBAAgB,QAAQ,MAAM,SAAS,GAAG,GAAG;AAChD,UAAM,CAAC,WAAW,GAAG,SAAS,IAAI,QAAQ,MAAM,MAAM,GAAG;AACzD,UAAM,cAAc,SAAS,gBAAgB,YAAY,SAAS;AAClE,QAAI,aAAa,SAAS,QAAS,QAAO;AAC1C,UAAM,WAAW,UAAU,KAAK,GAAG;AACnC,WAAO;AAAA,MACL,YAAY,0BAA0B,YAAY,UAAU,QAAQ;AAAA,MACpE,UAAU,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,aAAc,QAAO;AAE1B,MAAI,aAAa,SAAS,eAAe,QAAQ,aAAa;AAC5D,WAAO;AAAA,MACL,YAAY,yBAAyB,aAAa,UAAU,QAAQ,WAAW;AAAA,MAC/E,UAAU,aAAa;AAAA,MACvB,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,aAAa,UAAU,UAAU,aAAa,UAAU,UAAU,KAAK;AAC9F;AAuBA,SAAS,yBAAyB,OAA2B;AAC3D,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,UAAU,SAAY,CAAC,IAAI,CAAC,KAAK;AAC/E,MAAI,OAAO,KAAK,CAAC,WAAW,WAAW,QAAQ,WAAW,MAAS,GAAG;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,iBACP,SACuC;AACvC,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAEhC,eAAa,KAAK,eAAe;AACjC,SAAO,KAAK,QAAQ,MAAM,QAAQ;AAElC,MAAI,QAAQ,MAAM,mBAAmB,QAAQ,MAAM,gBAAgB,SAAS,GAAG;AAC7E,iBAAa,KAAK,kCAAkC;AACpD,WAAO,KAAK,IAAI,QAAQ,MAAM,gBAAgB,KAAK,GAAG,CAAC,GAAG;AAAA,EAC5D;AAEA,eAAa,KAAK,oBAAoB;AAEtC,MAAI,QAAQ,WAAW;AACrB,UAAM,cAAc,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,UAAU,KAAK;AACxF,QAAI,aAAa;AACf,mBAAa,KAAK,GAAG,YAAY,QAAQ,OAAO;AAChD,aAAO,KAAK,QAAQ,UAAU,KAAK;AACnC,mBAAa,KAAK,GAAG,YAAY,QAAQ,OAAO;AAChD,aAAO,KAAK,QAAQ,UAAU,GAAG;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,QAAQ,SAAS;AACnB,eAAW,UAAU,QAAQ,SAAS;AACpC,YAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,OAAO,KAAK;AAC/E,UAAI,CAAC,cAAe;AAEpB,cAAQ,OAAO,UAAU;AAAA,QACvB,KAAK;AACH,cAAI,OAAO,UAAU,MAAM;AACzB,yBAAa,KAAK,GAAG,cAAc,QAAQ,UAAU;AACrD;AAAA,UACF;AACA,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,OAAO,UAAU,MAAM;AACzB,yBAAa,KAAK,GAAG,cAAc,QAAQ,cAAc;AACzD;AAAA,UACF;AACA,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AAAA,QACL,KAAK,UAAU;AACb,gBAAM,SAAS,yBAAyB,OAAO,KAAK;AACpD,cAAI,OAAO,WAAW,GAAG;AACvB,yBAAa,KAAK,OAAO,aAAa,OAAO,UAAU,MAAM;AAC7D;AAAA,UACF;AACA,gBAAM,UAAU,OAAO,aAAa,OAAO,OAAO;AAClD,gBAAM,eAAe,OAAO,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACpD,uBAAa,KAAK,GAAG,cAAc,QAAQ,IAAI,OAAO,KAAK,YAAY,GAAG;AAC1E,iBAAO,KAAK,GAAG,MAAM;AACrB;AAAA,QACF;AAAA,QACA,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,UAAU;AACrD;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,cAAc;AACzD;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,IAAI,SAAS,aAAa,KAAK,OAAO,CAAC,KAAK,IAAI,OAAO;AAChG;AAEA,SAAS,iBAAiB,QAAkC;AAC1D,SAAO,OAAO,SAAS,IAAI,OAAO,MAAM,MAAM,OAAO,SAAS,MAAM,IAAI,OAAO,SAAS;AAC1F;AAaO,SAAS,2BACd,SACyB;AACzB,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,QAAQ,cAAe,QAAO;AAEnC,QAAM,kBAAkB,SAAS,gBAAgB,QAAQ,YAAY,OAAO,aAAa;AACzF,MAAI,CAAC,mBAAmB,CAAC,iBAAiB,gBAAgB,QAAQ,EAAG,QAAO;AAE5E,QAAM,QAAQ,iBAAiB,OAAO;AACtC,QAAM,+BAA+B,sBAAsB,gBAAgB,QAAQ;AACnF,QAAM,MAAM;AAAA,IACV,mBAAmB,4BAA4B;AAAA,IAC/C,QAAQ,iBAAiB,MAAM,CAAC;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EACF,EACG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;AAEO,SAAS,sBAAsB,SAAgE;AACpG,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AACvF,MAAI,CAAC,cAAe,QAAO;AAE3B,QAAM,YAAY,iBAAiB,MAAM;AACzC,QAAM,gBAAgB,yBAAyB,QAAQ,OAAO,WAAW,cAAc,QAAQ;AAE/F,MAAI,eAAe,UAAU,aAAa;AAC1C,MAAI,gBAAgB;AACpB,MAAI,gBAAgB;AACpB,MAAI,cAAc;AAElB,MAAI,QAAQ,SAAS;AACnB,UAAM,WAAW,uBAAuB,UAAU,QAAQ,YAAY,QAAQ,OAAO;AAErF,QAAI,UAAU;AACZ,qBAAe,UAAU,SAAS,UAAU,kBAAkB,aAAa;AAC3E,sBAAgB,YAAY,SAAS,UAAU;AAI/C,sBAAgB;AAEhB,UAAI,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,GAAG;AACtD,sBAAc,SAAS,KAAK,IAAI,QAAQ,QAAQ,OAAO,GAAG,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB,OAAO;AAEtC,QAAM,MAAM,CAAC,cAAc,QAAQ,SAAS,IAAI,MAAM,QAAQ,eAAe,eAAe,WAAW,EACpG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;AAcO,SAAS,0BAA0B,SAAoE;AAC5G,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AACvF,MAAI,CAAC,cAAe,QAAO;AAE3B,MAAI,CAAC,iBAAiB,QAAQ,WAAW,GAAG;AAC1C,UAAM,IAAI,MAAM,yBAAyB,QAAQ,WAAW,EAAE;AAAA,EAChE;AAEA,QAAM,QAAQ,iBAAiB,OAAO;AACtC,QAAM,MAAM;AAAA,IACV,UAAU,QAAQ,WAAW,qBAAqB,cAAc,QAAQ;AAAA,IACxE,QAAQ,iBAAiB,MAAM,CAAC;AAAA,IAChC,MAAM;AAAA,IACN,SAAS,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,QAAQ,CAAC,IAAI,CAAC;AAAA,EACxD,EACG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;",
+  "sourcesContent": ["import type { AnalyticsRegistry } from '../services/analyticsRegistry'\nimport type { AnalyticsEntityTypeConfig, AnalyticsFieldMapping } from '@open-mercato/shared/modules/analytics'\n\nexport type AggregateFunction = 'count' | 'sum' | 'avg' | 'min' | 'max'\nexport type DateGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year'\n\nconst VALID_GRANULARITIES: readonly DateGranularity[] = ['day', 'week', 'month', 'quarter', 'year']\nconst VALID_AGGREGATES: readonly AggregateFunction[] = ['count', 'sum', 'avg', 'min', 'max']\nconst SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/\n\nexport function isValidGranularity(value: unknown): value is DateGranularity {\n  return typeof value === 'string' && VALID_GRANULARITIES.includes(value as DateGranularity)\n}\n\nexport function isValidAggregate(value: unknown): value is AggregateFunction {\n  return typeof value === 'string' && VALID_AGGREGATES.includes(value as AggregateFunction)\n}\n\nfunction isSafeIdentifier(value: string): boolean {\n  return SAFE_IDENTIFIER_PATTERN.test(value)\n}\n\n// Re-export types from shared module for convenience\nexport type EntityTypeConfig = AnalyticsEntityTypeConfig\nexport type FieldMapping = AnalyticsFieldMapping\n\nexport function buildAggregateExpression(aggregate: AggregateFunction, column: string): string {\n  switch (aggregate) {\n    case 'count':\n      return column === 'id' ? 'COUNT(*)' : `COUNT(${column})`\n    case 'sum':\n      return `COALESCE(SUM(${column}::numeric), 0)`\n    case 'avg':\n      return `COALESCE(AVG(${column}::numeric), 0)`\n    case 'min':\n      return `MIN(${column}::numeric)`\n    case 'max':\n      return `MAX(${column}::numeric)`\n    default:\n      return `COUNT(*)`\n  }\n}\n\nexport function buildDateTruncExpression(column: string, granularity: DateGranularity): string {\n  if (!isValidGranularity(granularity)) {\n    throw new Error(`Invalid granularity: ${granularity}`)\n  }\n  return `DATE_TRUNC('${granularity}', ${column})`\n}\n\nexport function buildJsonbFieldExpression(column: string, path: string): string {\n  const parts = path.split('.')\n  for (const part of parts) {\n    if (!isSafeIdentifier(part)) {\n      throw new Error(`Invalid JSONB path part: ${part}`)\n    }\n  }\n  if (parts.length === 1) {\n    return `${column}->>'${parts[0]}'`\n  }\n  const intermediate = parts.slice(0, -1).map((p) => `'${p}'`).join('->')\n  const lastPart = parts[parts.length - 1]\n  return `${column}->${intermediate}->>'${lastPart}'`\n}\n\nexport type AggregationQuery = {\n  sql: string\n  params: unknown[]\n}\n\nexport type BuildAggregationQueryOptions = {\n  entityType: string\n  metric: {\n    field: string\n    aggregate: AggregateFunction\n  }\n  groupBy?: {\n    field: string\n    granularity?: DateGranularity\n    limit?: number\n  }\n  dateRange?: {\n    field: string\n    start: Date\n    end: Date\n  }\n  filters?: Array<{\n    field: string\n    operator: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'is_null' | 'is_not_null'\n    value?: unknown\n  }>\n  scope: {\n    tenantId: string\n    organizationIds?: string[]\n  }\n  /** Analytics registry for resolving entity and field configurations */\n  registry: AnalyticsRegistry\n}\n\nexport type ResolvedGroupExpression = {\n  expression: string\n  /** Column the group expression reads from \u2014 the encryption map is keyed by this. */\n  dbColumn: string\n  /** JSONB path below `dbColumn`, when the groupBy field used path notation. */\n  jsonPath: string | null\n}\n\n/**\n * Resolves the SQL expression a groupBy field maps to, together with the underlying column so\n * callers can decide whether the source is encrypted at rest before grouping over it (#4622).\n */\nexport function resolveGroupExpression(\n  registry: AnalyticsRegistry,\n  entityType: string,\n  groupBy: { field: string; granularity?: DateGranularity },\n): ResolvedGroupExpression | null {\n  const groupMapping = registry.getFieldMapping(entityType, groupBy.field)\n\n  // Handle JSONB path notation (e.g., shippingAddressSnapshot.region)\n  if (!groupMapping && groupBy.field.includes('.')) {\n    const [baseField, ...pathParts] = groupBy.field.split('.')\n    const baseMapping = registry.getFieldMapping(entityType, baseField)\n    if (baseMapping?.type !== 'jsonb') return null\n    const jsonPath = pathParts.join('.')\n    return {\n      expression: buildJsonbFieldExpression(baseMapping.dbColumn, jsonPath),\n      dbColumn: baseMapping.dbColumn,\n      jsonPath,\n    }\n  }\n\n  if (!groupMapping) return null\n\n  if (groupMapping.type === 'timestamp' && groupBy.granularity) {\n    return {\n      expression: buildDateTruncExpression(groupMapping.dbColumn, groupBy.granularity),\n      dbColumn: groupMapping.dbColumn,\n      jsonPath: null,\n    }\n  }\n\n  return { expression: groupMapping.dbColumn, dbColumn: groupMapping.dbColumn, jsonPath: null }\n}\n\n/**\n * Normalizes the value of a set filter (`in` / `not_in`) into the list of members it selects.\n *\n * The list is rendered as one placeholder per member rather than as a single array parameter:\n * MikroORM does not bind parameters at the driver level \u2014 `AbstractSqlConnection.execute` calls\n * `platform.formatQuery`, which interpolates each value through `BasePostgreSqlPlatform.escape`,\n * and that renders a JavaScript array as a bare comma-separated list. The previous\n * `= ANY(?)` / `!= ALL(?)` form therefore produced `= ANY('a', 'b')`, which PostgreSQL rejects\n * for every shape of value (#4669).\n *\n * A missing value yields an empty set rather than a dropped filter, so an `in` filter the caller\n * failed to populate selects nothing instead of silently widening the result.\n *\n * A null or undefined *member* is refused instead of rendered. `column IN (NULL)` matches no row\n * and `column NOT IN ('a', NULL)` is NULL for every row, so such a member would return an empty\n * aggregation with no error \u2014 a silent zero on a reporting surface, which is worse than a loud\n * failure. Requests are already rejected at the API boundary by `widgetDataFilterSchema` in\n * `api/widgets/data/schema.ts`; this throw keeps in-process callers, whose filter values are\n * typed as `unknown`, from reaching the same silent path. Nullness is queried with the dedicated\n * `is_null` / `is_not_null` operators.\n */\nfunction normalizeSetFilterValues(value: unknown): unknown[] {\n  const values = Array.isArray(value) ? value : value === undefined ? [] : [value]\n  if (values.some((member) => member === null || member === undefined)) {\n    throw new Error(\n      '[internal] Set filter members must not be null or undefined \u2014 use the is_null / is_not_null operators to filter on nullness',\n    )\n  }\n  return values\n}\n\n/**\n * Builds the shared WHERE clause every aggregation query reads from, together with its parameters.\n *\n * The `eq` / `neq` cases branch on a null value instead of binding it (#5016). Under SQL\n * three-valued logic neither `column = NULL` nor `column != NULL` is ever `TRUE`, so binding a raw\n * null selected zero rows and rendered as a legitimate-looking empty aggregation \u2014 a silent zero on\n * a reporting surface. Nullness has to be asked with the `IS NULL` / `IS NOT NULL` keywords, which\n * take no parameter; that is also what the dedicated `is_null` / `is_not_null` operators emit, and\n * it mirrors how the query index builds column filters (`query_index/lib/engine.ts`).\n *\n * The ordering operators (`gt`/`gte`/`lt`/`lte`) deliberately keep binding the value: comparing an\n * ordering against NULL is genuinely undefined rather than a mistake, so their never-`TRUE` result\n * is the correct answer. Set operators refuse null members outright \u2014 see\n * `normalizeSetFilterValues`.\n */\nfunction buildWhereClause(\n  options: Pick<BuildAggregationQueryOptions, 'entityType' | 'dateRange' | 'filters' | 'scope' | 'registry'>,\n): { clause: string; params: unknown[] } {\n  const { registry } = options\n  const params: unknown[] = []\n  const whereClauses: string[] = []\n\n  whereClauses.push(`tenant_id = ?`)\n  params.push(options.scope.tenantId)\n\n  if (options.scope.organizationIds !== undefined) {\n    whereClauses.push(`organization_id = ANY(?::uuid[])`)\n    params.push(`{${options.scope.organizationIds.join(',')}}`)\n  }\n\n  whereClauses.push(`deleted_at IS NULL`)\n\n  if (options.dateRange) {\n    const dateMapping = registry.getFieldMapping(options.entityType, options.dateRange.field)\n    if (dateMapping) {\n      whereClauses.push(`${dateMapping.dbColumn} >= ?`)\n      params.push(options.dateRange.start)\n      whereClauses.push(`${dateMapping.dbColumn} <= ?`)\n      params.push(options.dateRange.end)\n    }\n  }\n\n  if (options.filters) {\n    for (const filter of options.filters) {\n      const filterMapping = registry.getFieldMapping(options.entityType, filter.field)\n      if (!filterMapping) continue\n\n      switch (filter.operator) {\n        case 'eq':\n          if (filter.value === null) {\n            whereClauses.push(`${filterMapping.dbColumn} IS NULL`)\n            break\n          }\n          whereClauses.push(`${filterMapping.dbColumn} = ?`)\n          params.push(filter.value)\n          break\n        case 'neq':\n          if (filter.value === null) {\n            whereClauses.push(`${filterMapping.dbColumn} IS NOT NULL`)\n            break\n          }\n          whereClauses.push(`${filterMapping.dbColumn} != ?`)\n          params.push(filter.value)\n          break\n        case 'gt':\n          whereClauses.push(`${filterMapping.dbColumn} > ?`)\n          params.push(filter.value)\n          break\n        case 'gte':\n          whereClauses.push(`${filterMapping.dbColumn} >= ?`)\n          params.push(filter.value)\n          break\n        case 'lt':\n          whereClauses.push(`${filterMapping.dbColumn} < ?`)\n          params.push(filter.value)\n          break\n        case 'lte':\n          whereClauses.push(`${filterMapping.dbColumn} <= ?`)\n          params.push(filter.value)\n          break\n        case 'in':\n        case 'not_in': {\n          const values = normalizeSetFilterValues(filter.value)\n          if (values.length === 0) {\n            whereClauses.push(filter.operator === 'in' ? 'FALSE' : 'TRUE')\n            break\n          }\n          const keyword = filter.operator === 'in' ? 'IN' : 'NOT IN'\n          const placeholders = values.map(() => '?').join(', ')\n          whereClauses.push(`${filterMapping.dbColumn} ${keyword} (${placeholders})`)\n          params.push(...values)\n          break\n        }\n        case 'is_null':\n          whereClauses.push(`${filterMapping.dbColumn} IS NULL`)\n          break\n        case 'is_not_null':\n          whereClauses.push(`${filterMapping.dbColumn} IS NOT NULL`)\n          break\n      }\n    }\n  }\n\n  return { clause: whereClauses.length > 0 ? `WHERE ${whereClauses.join(' AND ')}` : '', params }\n}\n\nfunction resolveTableName(config: EntityTypeConfig): string {\n  return config.schema ? `\"${config.schema}\".\"${config.tableName}\"` : `\"${config.tableName}\"`\n}\n\nexport type BuildDistinctCurrencyQueryOptions = Pick<\n  BuildAggregationQueryOptions,\n  'entityType' | 'dateRange' | 'filters' | 'scope' | 'registry'\n>\n\n/**\n * Builds the query that reads the distinct per-row currencies of the rows an aggregation\n * would sum, over exactly the same tenant/organization scope, date range and filters.\n * Returns `null` when the entity declares no `currencyField`, which means its amounts are\n * not per-row denominated and there is nothing to verify (#4676).\n */\nexport function buildDistinctCurrencyQuery(\n  options: BuildDistinctCurrencyQueryOptions,\n): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config?.currencyField) return null\n\n  const currencyMapping = registry.getFieldMapping(options.entityType, config.currencyField)\n  if (!currencyMapping || !isSafeIdentifier(currencyMapping.dbColumn)) return null\n\n  const where = buildWhereClause(options)\n  const normalizedCurrencyExpression = `UPPER(NULLIF(BTRIM(${currencyMapping.dbColumn}), ''))`\n  const sql = [\n    `SELECT DISTINCT ${normalizedCurrencyExpression} AS code`,\n    `FROM ${resolveTableName(config)}`,\n    where.clause,\n    'LIMIT 2',\n  ]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n\nexport function buildAggregationQuery(options: BuildAggregationQueryOptions): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config) return null\n\n  const metricMapping = registry.getFieldMapping(options.entityType, options.metric.field)\n  if (!metricMapping) return null\n\n  const tableName = resolveTableName(config)\n  const aggregateExpr = buildAggregateExpression(options.metric.aggregate, metricMapping.dbColumn)\n\n  let selectClause = `SELECT ${aggregateExpr} AS value`\n  let groupByClause = ''\n  let orderByClause = ''\n  let limitClause = ''\n\n  if (options.groupBy) {\n    const resolved = resolveGroupExpression(registry, options.entityType, options.groupBy)\n\n    if (resolved) {\n      selectClause = `SELECT ${resolved.expression} AS group_key, ${aggregateExpr} AS value`\n      groupByClause = `GROUP BY ${resolved.expression}`\n      // NULLS LAST is stated explicitly (PostgreSQL defaults DESC to NULLS FIRST) so a group limit\n      // keeps the highest-value buckets instead of the empty ones, and so the application-side\n      // encrypted path can mirror the same ordering (#4622).\n      orderByClause = `ORDER BY value DESC NULLS LAST`\n\n      if (options.groupBy.limit && options.groupBy.limit > 0) {\n        limitClause = `LIMIT ${Math.min(options.groupBy.limit, 100)}`\n      }\n    }\n  }\n\n  const where = buildWhereClause(options)\n\n  const sql = [selectClause, `FROM ${tableName}`, where.clause, groupByClause, orderByClause, limitClause]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n\nexport type BuildGroupSourceRowsQueryOptions = Omit<BuildAggregationQueryOptions, 'groupBy'> & {\n  /** Column holding the (encrypted) group source, resolved via `resolveGroupExpression`. */\n  groupColumn: string\n  /** Hard cap on scanned rows; callers fetch `rowLimit + 1` to detect overflow. */\n  rowLimit: number\n}\n\n/**\n * Builds a per-row query for group sources that cannot be grouped in SQL because the column is\n * encrypted at rest. Returns the raw group source alongside the metric value so the caller can\n * decrypt, then aggregate in application code (#4622).\n */\nexport function buildGroupSourceRowsQuery(options: BuildGroupSourceRowsQueryOptions): AggregationQuery | null {\n  const { registry } = options\n  const config = registry.getEntityTypeConfig(options.entityType)\n  if (!config) return null\n\n  const metricMapping = registry.getFieldMapping(options.entityType, options.metric.field)\n  if (!metricMapping) return null\n\n  if (!isSafeIdentifier(options.groupColumn)) {\n    throw new Error(`Invalid group column: ${options.groupColumn}`)\n  }\n\n  const where = buildWhereClause(options)\n  const sql = [\n    `SELECT ${options.groupColumn} AS group_source, ${metricMapping.dbColumn} AS metric_value`,\n    `FROM ${resolveTableName(config)}`,\n    where.clause,\n    `LIMIT ${Math.max(1, Math.floor(options.rowLimit)) + 1}`,\n  ]\n    .filter(Boolean)\n    .join(' ')\n\n  return { sql, params: where.params }\n}\n"],
+  "mappings": "AAMA,MAAM,sBAAkD,CAAC,OAAO,QAAQ,SAAS,WAAW,MAAM;AAClG,MAAM,mBAAiD,CAAC,SAAS,OAAO,OAAO,OAAO,KAAK;AAC3F,MAAM,0BAA0B;AAEzB,SAAS,mBAAmB,OAA0C;AAC3E,SAAO,OAAO,UAAU,YAAY,oBAAoB,SAAS,KAAwB;AAC3F;AAEO,SAAS,iBAAiB,OAA4C;AAC3E,SAAO,OAAO,UAAU,YAAY,iBAAiB,SAAS,KAA0B;AAC1F;AAEA,SAAS,iBAAiB,OAAwB;AAChD,SAAO,wBAAwB,KAAK,KAAK;AAC3C;AAMO,SAAS,yBAAyB,WAA8B,QAAwB;AAC7F,UAAQ,WAAW;AAAA,IACjB,KAAK;AACH,aAAO,WAAW,OAAO,aAAa,SAAS,MAAM;AAAA,IACvD,KAAK;AACH,aAAO,gBAAgB,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,gBAAgB,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB;AACE,aAAO;AAAA,EACX;AACF;AAEO,SAAS,yBAAyB,QAAgB,aAAsC;AAC7F,MAAI,CAAC,mBAAmB,WAAW,GAAG;AACpC,UAAM,IAAI,MAAM,wBAAwB,WAAW,EAAE;AAAA,EACvD;AACA,SAAO,eAAe,WAAW,MAAM,MAAM;AAC/C;AAEO,SAAS,0BAA0B,QAAgB,MAAsB;AAC9E,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,iBAAiB,IAAI,GAAG;AAC3B,YAAM,IAAI,MAAM,4BAA4B,IAAI,EAAE;AAAA,IACpD;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,GAAG,MAAM,OAAO,MAAM,CAAC,CAAC;AAAA,EACjC;AACA,QAAM,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AACtE,QAAM,WAAW,MAAM,MAAM,SAAS,CAAC;AACvC,SAAO,GAAG,MAAM,KAAK,YAAY,OAAO,QAAQ;AAClD;AAgDO,SAAS,uBACd,UACA,YACA,SACgC;AAChC,QAAM,eAAe,SAAS,gBAAgB,YAAY,QAAQ,KAAK;AAGvE,MAAI,CAAC,gBAAgB,QAAQ,MAAM,SAAS,GAAG,GAAG;AAChD,UAAM,CAAC,WAAW,GAAG,SAAS,IAAI,QAAQ,MAAM,MAAM,GAAG;AACzD,UAAM,cAAc,SAAS,gBAAgB,YAAY,SAAS;AAClE,QAAI,aAAa,SAAS,QAAS,QAAO;AAC1C,UAAM,WAAW,UAAU,KAAK,GAAG;AACnC,WAAO;AAAA,MACL,YAAY,0BAA0B,YAAY,UAAU,QAAQ;AAAA,MACpE,UAAU,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,aAAc,QAAO;AAE1B,MAAI,aAAa,SAAS,eAAe,QAAQ,aAAa;AAC5D,WAAO;AAAA,MACL,YAAY,yBAAyB,aAAa,UAAU,QAAQ,WAAW;AAAA,MAC/E,UAAU,aAAa;AAAA,MACvB,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,aAAa,UAAU,UAAU,aAAa,UAAU,UAAU,KAAK;AAC9F;AAuBA,SAAS,yBAAyB,OAA2B;AAC3D,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,UAAU,SAAY,CAAC,IAAI,CAAC,KAAK;AAC/E,MAAI,OAAO,KAAK,CAAC,WAAW,WAAW,QAAQ,WAAW,MAAS,GAAG;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,iBACP,SACuC;AACvC,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAoB,CAAC;AAC3B,QAAM,eAAyB,CAAC;AAEhC,eAAa,KAAK,eAAe;AACjC,SAAO,KAAK,QAAQ,MAAM,QAAQ;AAElC,MAAI,QAAQ,MAAM,oBAAoB,QAAW;AAC/C,iBAAa,KAAK,kCAAkC;AACpD,WAAO,KAAK,IAAI,QAAQ,MAAM,gBAAgB,KAAK,GAAG,CAAC,GAAG;AAAA,EAC5D;AAEA,eAAa,KAAK,oBAAoB;AAEtC,MAAI,QAAQ,WAAW;AACrB,UAAM,cAAc,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,UAAU,KAAK;AACxF,QAAI,aAAa;AACf,mBAAa,KAAK,GAAG,YAAY,QAAQ,OAAO;AAChD,aAAO,KAAK,QAAQ,UAAU,KAAK;AACnC,mBAAa,KAAK,GAAG,YAAY,QAAQ,OAAO;AAChD,aAAO,KAAK,QAAQ,UAAU,GAAG;AAAA,IACnC;AAAA,EACF;AAEA,MAAI,QAAQ,SAAS;AACnB,eAAW,UAAU,QAAQ,SAAS;AACpC,YAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,OAAO,KAAK;AAC/E,UAAI,CAAC,cAAe;AAEpB,cAAQ,OAAO,UAAU;AAAA,QACvB,KAAK;AACH,cAAI,OAAO,UAAU,MAAM;AACzB,yBAAa,KAAK,GAAG,cAAc,QAAQ,UAAU;AACrD;AAAA,UACF;AACA,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,cAAI,OAAO,UAAU,MAAM;AACzB,yBAAa,KAAK,GAAG,cAAc,QAAQ,cAAc;AACzD;AAAA,UACF;AACA,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,MAAM;AACjD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,OAAO;AAClD,iBAAO,KAAK,OAAO,KAAK;AACxB;AAAA,QACF,KAAK;AAAA,QACL,KAAK,UAAU;AACb,gBAAM,SAAS,yBAAyB,OAAO,KAAK;AACpD,cAAI,OAAO,WAAW,GAAG;AACvB,yBAAa,KAAK,OAAO,aAAa,OAAO,UAAU,MAAM;AAC7D;AAAA,UACF;AACA,gBAAM,UAAU,OAAO,aAAa,OAAO,OAAO;AAClD,gBAAM,eAAe,OAAO,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACpD,uBAAa,KAAK,GAAG,cAAc,QAAQ,IAAI,OAAO,KAAK,YAAY,GAAG;AAC1E,iBAAO,KAAK,GAAG,MAAM;AACrB;AAAA,QACF;AAAA,QACA,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,UAAU;AACrD;AAAA,QACF,KAAK;AACH,uBAAa,KAAK,GAAG,cAAc,QAAQ,cAAc;AACzD;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,aAAa,SAAS,IAAI,SAAS,aAAa,KAAK,OAAO,CAAC,KAAK,IAAI,OAAO;AAChG;AAEA,SAAS,iBAAiB,QAAkC;AAC1D,SAAO,OAAO,SAAS,IAAI,OAAO,MAAM,MAAM,OAAO,SAAS,MAAM,IAAI,OAAO,SAAS;AAC1F;AAaO,SAAS,2BACd,SACyB;AACzB,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,QAAQ,cAAe,QAAO;AAEnC,QAAM,kBAAkB,SAAS,gBAAgB,QAAQ,YAAY,OAAO,aAAa;AACzF,MAAI,CAAC,mBAAmB,CAAC,iBAAiB,gBAAgB,QAAQ,EAAG,QAAO;AAE5E,QAAM,QAAQ,iBAAiB,OAAO;AACtC,QAAM,+BAA+B,sBAAsB,gBAAgB,QAAQ;AACnF,QAAM,MAAM;AAAA,IACV,mBAAmB,4BAA4B;AAAA,IAC/C,QAAQ,iBAAiB,MAAM,CAAC;AAAA,IAChC,MAAM;AAAA,IACN;AAAA,EACF,EACG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;AAEO,SAAS,sBAAsB,SAAgE;AACpG,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AACvF,MAAI,CAAC,cAAe,QAAO;AAE3B,QAAM,YAAY,iBAAiB,MAAM;AACzC,QAAM,gBAAgB,yBAAyB,QAAQ,OAAO,WAAW,cAAc,QAAQ;AAE/F,MAAI,eAAe,UAAU,aAAa;AAC1C,MAAI,gBAAgB;AACpB,MAAI,gBAAgB;AACpB,MAAI,cAAc;AAElB,MAAI,QAAQ,SAAS;AACnB,UAAM,WAAW,uBAAuB,UAAU,QAAQ,YAAY,QAAQ,OAAO;AAErF,QAAI,UAAU;AACZ,qBAAe,UAAU,SAAS,UAAU,kBAAkB,aAAa;AAC3E,sBAAgB,YAAY,SAAS,UAAU;AAI/C,sBAAgB;AAEhB,UAAI,QAAQ,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,GAAG;AACtD,sBAAc,SAAS,KAAK,IAAI,QAAQ,QAAQ,OAAO,GAAG,CAAC;AAAA,MAC7D;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB,OAAO;AAEtC,QAAM,MAAM,CAAC,cAAc,QAAQ,SAAS,IAAI,MAAM,QAAQ,eAAe,eAAe,WAAW,EACpG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;AAcO,SAAS,0BAA0B,SAAoE;AAC5G,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,SAAS,oBAAoB,QAAQ,UAAU;AAC9D,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,gBAAgB,SAAS,gBAAgB,QAAQ,YAAY,QAAQ,OAAO,KAAK;AACvF,MAAI,CAAC,cAAe,QAAO;AAE3B,MAAI,CAAC,iBAAiB,QAAQ,WAAW,GAAG;AAC1C,UAAM,IAAI,MAAM,yBAAyB,QAAQ,WAAW,EAAE;AAAA,EAChE;AAEA,QAAM,QAAQ,iBAAiB,OAAO;AACtC,QAAM,MAAM;AAAA,IACV,UAAU,QAAQ,WAAW,qBAAqB,cAAc,QAAQ;AAAA,IACxE,QAAQ,iBAAiB,MAAM,CAAC;AAAA,IAChC,MAAM;AAAA,IACN,SAAS,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,QAAQ,CAAC,IAAI,CAAC;AAAA,EACxD,EACG,OAAO,OAAO,EACd,KAAK,GAAG;AAEX,SAAO,EAAE,KAAK,QAAQ,MAAM,OAAO;AACrC;",
   "names": []
 }

package/dist/modules/dashboards/lib/widgetScope.js

@@ -3,6 +3,7 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { isUnrestrictedOrganizationScope } from "@open-mercato/shared/lib/auth/organizationAccess";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 function normalizeScopeId(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -41,13 +42,7 @@ async function resolveWidgetScope(req, translate, overrides) {
   if (requestedOrganizationId && (scope?.selectionRejected || scope?.selectedId !== requestedOrganizationId)) {
     throw forbiddenScope();
   }
-  const organizationIds = (() => {
-    if (scope?.selectedId) return [scope.selectedId];
-    if (Array.isArray(scope?.filterIds) && scope.filterIds.length > 0) return scope.filterIds;
-    if (scope?.allowedIds === null) return null;
-    if (auth.orgId) return [auth.orgId];
-    return [];
-  })();
+  const organizationIds = resolveOrganizationScopeFilter(scope, auth).organizationIds ?? null;
   if (organizationIds !== null && organizationIds.length === 0) {
     throw new CrudHttpError(400, { error: translate("dashboards.errors.organization_required", "Organization context is required") });
   }