@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/devices/api/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/devices/api/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { UserDevice } from '../../data/entities'\nimport { updateDeviceSchema } from '../../data/validators'\nimport { resolveDeviceActorUserId } from '../auth'\nimport { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../deviceOps'\n\nconst logger = createLogger('devices')\n\n// Self-serve: the caller may only mutate their OWN device. Cross-user device administration lives in\n// api/admin/devices/[id] (gated by devices.admin).\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['devices.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['devices.manage'] },\n}\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const body = updateDeviceSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    // Self devices are scoped to the caller's active organization, mirroring the list route and the\n    // user-owned-resource convention (e.g. progress jobs): a device outside the current org context\n    // reads as not-found. When there is no active org, scope by tenant only.\n    const currentOrganizationId = scope?.selectedId ?? auth.orgId ?? null\n    const em = container.resolve('em') as EntityManager\n    const device = await findOneWithDecryption(\n      em,\n      UserDevice,\n      {\n        id: parsedParams.data.id,\n        tenantId: auth.tenantId,\n        ...(currentOrganizationId ? { organizationId: currentOrganizationId } : {}),\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId: currentOrganizationId },\n    )\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    if (device.userId !== actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeUpdate(mctx, device, body)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.PUT failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.update_failed', 'Failed to update device') }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    // Same active-org scoping as PUT/the list route: a device outside the current org reads as not-found.\n    const currentOrganizationId = scope?.selectedId ?? auth.orgId ?? null\n    const em = container.resolve('em') as EntityManager\n    const device = await findOneWithDecryption(\n      em,\n      UserDevice,\n      {\n        id: parsedParams.data.id,\n        tenantId: auth.tenantId,\n        ...(currentOrganizationId ? { organizationId: currentOrganizationId } : {}),\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId: currentOrganizationId },\n    )\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    if (device.userId !== actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeDeactivate(mctx, device)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.DELETE failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.delete_failed', 'Failed to delete device') }, { status: 500 })\n  }\n}\n\nconst okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })\nconst errorResponseSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Devices',\n  summary: 'Update or deactivate one of your registered devices',\n  methods: {\n    PUT: {\n      summary: 'Update your device',\n      description:\n        'Updates last-seen, app/OS metadata, and push token for a device owned by the current user. Set pushToken to null to clear a revoked OS permission.',\n      requestBody: { schema: updateDeviceSchema },\n      responses: [{ status: 200, description: 'Device updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Not the device owner', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Deactivate your device',\n      description: 'Soft-deletes a device owned by the current user.',\n      responses: [{ status: 200, description: 'Device deactivated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Not the device owner', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,gCAAgC;AACzC,SAAS,eAAe,yBAAqD;AAE7E,MAAM,SAAS,aAAa,SAAS;AAI9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACnE;AAEA,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,OAAO,mBAAmB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACjE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAIxF,UAAM,wBAAwB,OAAO,cAAc,KAAK,SAAS;AACjE,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,aAAa,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,QACf,GAAI,wBAAwB,EAAE,gBAAgB,sBAAsB,IAAI,CAAC;AAAA,QACzE,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,sBAAsB;AAAA,IACnE;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAEA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,UAAM,wBAAwB,OAAO,cAAc,KAAK,SAAS;AACjE,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,aAAa,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,QACf,GAAI,wBAAwB,EAAE,gBAAgB,sBAAsB,IAAI,CAAC;AAAA,QACzE,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,sBAAsB;AAAA,IACnE;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAEA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,kBAAkB,MAAM,MAAM;AAAA,EAC7C,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC3F,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnD,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB,CAAC;AAAA,MACxF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { UserDevice } from '../../data/entities'\nimport { updateDeviceSchema } from '../../data/validators'\nimport { resolveDeviceActorUserId } from '../auth'\nimport { executeUpdate, executeDeactivate, type DeviceMutationContext } from '../deviceOps'\n\nconst logger = createLogger('devices')\n\n// Self-serve: the caller may only mutate their OWN device. Cross-user device administration lives in\n// api/admin/devices/[id] (gated by devices.admin).\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['devices.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['devices.manage'] },\n}\n\nconst paramsSchema = z.object({ id: z.string().uuid() })\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const body = updateDeviceSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    // Self devices are scoped to the caller's active organization, mirroring the list route and the\n    // user-owned-resource convention (e.g. progress jobs): a device outside the current org context\n    // reads as not-found. When there is no active org, scope by tenant only.\n    const currentOrganizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    const em = container.resolve('em') as EntityManager\n    const device = await findOneWithDecryption(\n      em,\n      UserDevice,\n      {\n        id: parsedParams.data.id,\n        tenantId: auth.tenantId,\n        ...(currentOrganizationId ? { organizationId: currentOrganizationId } : {}),\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId: currentOrganizationId },\n    )\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    if (device.userId !== actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeUpdate(mctx, device, body)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.PUT failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.update_failed', 'Failed to update device') }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n    const parsedParams = paramsSchema.safeParse({ id: params.id })\n    if (!parsedParams.success) {\n      return NextResponse.json({ error: translate('devices.errors.invalid_id', 'Invalid device id') }, { status: 400 })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    // Same active-org scoping as PUT/the list route: a device outside the current org reads as not-found.\n    const currentOrganizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n    const em = container.resolve('em') as EntityManager\n    const device = await findOneWithDecryption(\n      em,\n      UserDevice,\n      {\n        id: parsedParams.data.id,\n        tenantId: auth.tenantId,\n        ...(currentOrganizationId ? { organizationId: currentOrganizationId } : {}),\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: auth.tenantId, organizationId: currentOrganizationId },\n    )\n    if (!device) {\n      return NextResponse.json({ error: translate('devices.errors.not_found', 'Device not found') }, { status: 404 })\n    }\n    if (device.userId !== actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    const mctx: DeviceMutationContext = {\n      container,\n      auth,\n      scope,\n      organizationId: device.organizationId ?? null,\n      actorUserId,\n      request: req,\n    }\n    return await executeDeactivate(mctx, device)\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.DELETE failed', { err })\n    return NextResponse.json({ error: translate('devices.errors.delete_failed', 'Failed to delete device') }, { status: 500 })\n  }\n}\n\nconst okResponseSchema = z.object({ ok: z.literal(true), id: z.string().uuid().optional() })\nconst errorResponseSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Devices',\n  summary: 'Update or deactivate one of your registered devices',\n  methods: {\n    PUT: {\n      summary: 'Update your device',\n      description:\n        'Updates last-seen, app/OS metadata, and push token for a device owned by the current user. Set pushToken to null to clear a revoked OS permission.',\n      requestBody: { schema: updateDeviceSchema },\n      responses: [{ status: 200, description: 'Device updated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload or id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Not the device owner', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Deactivate your device',\n      description: 'Soft-deletes a device owned by the current user.',\n      responses: [{ status: 200, description: 'Device deactivated', schema: okResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid id', schema: errorResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },\n        { status: 403, description: 'Not the device owner', schema: errorResponseSchema },\n        { status: 404, description: 'Device not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AAEpC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,gCAAgC;AACzC,SAAS,eAAe,yBAAqD;AAE7E,MAAM,SAAS,aAAa,SAAS;AAI9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACnE;AAEA,MAAM,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAEvD,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,OAAO,mBAAmB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACjE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAIxF,UAAM,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAChF,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,aAAa,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,QACf,GAAI,wBAAwB,EAAE,gBAAgB,sBAAsB,IAAI,CAAC;AAAA,QACzE,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,sBAAsB;AAAA,IACnE;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAEA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,cAAc,MAAM,QAAQ,IAAI;AAAA,EAC/C,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,sBAAsB,EAAE,IAAI,CAAC;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,UAAM,eAAe,aAAa,UAAU,EAAE,IAAI,OAAO,GAAG,CAAC;AAC7D,QAAI,CAAC,aAAa,SAAS;AACzB,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,6BAA6B,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClH;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,UAAM,wBAAwB,kCAAkC,OAAO,IAAI,KAAK;AAChF,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,aAAa,KAAK;AAAA,QACtB,UAAU,KAAK;AAAA,QACf,GAAI,wBAAwB,EAAE,gBAAgB,sBAAsB,IAAI,CAAC;AAAA,QACzE,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,sBAAsB;AAAA,IACnE;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChH;AACA,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAEA,UAAM,OAA8B;AAAA,MAClC;AAAA,MACA;AAAA,MACA;AAAA,MACA,gBAAgB,OAAO,kBAAkB;AAAA,MACzC;AAAA,MACA,SAAS;AAAA,IACX;AACA,WAAO,MAAM,kBAAkB,MAAM,MAAM;AAAA,EAC7C,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,gCAAgC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3H;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC3F,MAAM,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnD,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC;AAAA,MACpF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB,CAAC;AAAA,MACxF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,oBAAoB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oBAAoB;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/devices/api/admin/devices/route.js

@@ -5,6 +5,7 @@ import { toHeaderLabel } from "@open-mercato/shared/lib/crud/exporters";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -81,7 +82,7 @@ async function POST(req) {
     }
     const body = registerDeviceAdminSchema.parse(await readJsonSafe(req, {}));
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     const em = container.resolve("em");
     const targetUser = await em.findOne(
       User,

package/dist/modules/devices/api/admin/devices/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/devices/api/admin/devices/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { toHeaderLabel } from '@open-mercato/shared/lib/crud/exporters'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { E } from '#generated/entities.ids.generated'\nimport { UserDevice } from '../../../data/entities'\nimport {\n  registerDeviceAdminSchema,\n  registerDeviceCommandSchema,\n  type RegisterDeviceCommandInput,\n} from '../../../data/validators'\nimport { resolveDeviceActorUserId } from '../../auth'\nimport { createDevicesCrudOpenApi, createPagedListResponseSchema } from '../../openapi'\nimport {\n  deviceListSchema,\n  deviceListFields,\n  deviceListSortFieldMap,\n  deviceListItemSchema,\n  deviceExportColumnFields,\n  transformDeviceListItem,\n} from '../../deviceList'\nimport { executeRegister, type DeviceMutationContext } from '../../deviceOps'\n\nconst logger = createLogger('devices')\n\n// Admin device administration: cross-user listing + register-on-behalf-of-user. Gated by devices.admin.\n// Self-serve registration/listing stays on /api/devices (scoped to the acting user).\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  POST: { requireAuth: true, requireFeatures: ['devices.admin'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: UserDevice,\n    idField: 'id',\n    // organization_id stays nullable, but scoping follows the standard org-scoped pattern: the factory\n    // auto-filters by the caller's organization scope (null-aware in the query engine). Unrestricted\n    // admins see the whole tenant including null-org rows; org-restricted admins see only their orgs.\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.devices.user_device },\n  // Same cache resource tag as the self route + commands, so any device write busts both list caches.\n  events: { module: 'devices', entity: 'user_device' },\n  list: {\n    schema: deviceListSchema,\n    entityId: E.devices.user_device,\n    fields: deviceListFields,\n    sortFieldMap: deviceListSortFieldMap,\n    // The query engine projects raw column names; expose them in camelCase like every other module.\n    transformItem: transformDeviceListItem,\n    // Without an explicit column set the factory's default export spreads each item, so the deprecated\n    // snake_case aliases would double every column in the CSV/JSON/XML export.\n    export: { columns: deviceExportColumnFields.map((field) => ({ field, header: toHeaderLabel(field) })) },\n    // Tenant + org scope is enforced by the factory (orm.tenantField + orm.orgField); only the optional\n    // userId/platform narrowing is left to do here.\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (query.userId) filters.user_id = { $eq: query.userId }\n      if (query.platform) filters.platform = { $eq: query.platform }\n      return filters\n    },\n  },\n})\n\nexport const GET = crud.GET\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = registerDeviceAdminSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    // Validate the on-behalf-of target before registering. `body.userId` is caller-supplied, and the\n    // fan-out delivers by `(tenant, org, user)` \u2014 so without this an admin could register their OWN push\n    // token under an arbitrary `userId` (even a non-existent or cross-tenant one) and start receiving that\n    // user's notifications. Require a real, active user in the admin's tenant who is also within the\n    // admin's organization scope (org-restricted admins cannot reach users in orgs they can't access).\n    // Only non-encrypted columns are selected, so no decryption is needed.\n    const em = container.resolve('em') as EntityManager\n    const targetUser = await em.findOne(\n      User,\n      { id: body.userId, tenantId: auth.tenantId, deletedAt: null },\n      { fields: ['id', 'organizationId'] },\n    )\n    if (!targetUser) {\n      return NextResponse.json(\n        { error: translate('devices.errors.user_not_found', 'Target user not found in this tenant') },\n        { status: 400 },\n      )\n    }\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: targetUser.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    // Register is an idempotent upsert keyed per (tenant, org, user, device). organizationId is the\n    // admin's own resolved scope, so the upsert can only ever touch a row inside an org the admin can\n    // access \u2014 no cross-org guard is needed here.\n    const commandInput = registerDeviceCommandSchema.parse({\n      ...body,\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: body.userId,\n    } satisfies RegisterDeviceCommandInput)\n\n    // actorUserId is the admin (for the mutation guard/audit); the device is owned by body.userId.\n    const mctx: DeviceMutationContext = { container, auth, scope, organizationId, actorUserId, request: req }\n    return await executeRegister(mctx, commandInput)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err) && (err.body as { code?: string } | undefined)?.code === 'device_already_registered') {\n      return NextResponse.json(\n        { error: translate('devices.errors.already_registered', 'This device is already registered') },\n        { status: 409 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('devices.errors.register_failed', 'Failed to register device') },\n      { status: 500 },\n    )\n  }\n}\n\nconst registerResponseSchema = z.object({\n  id: z.string().uuid(),\n  deviceId: z.string(),\n  revived: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = createDevicesCrudOpenApi({\n  resourceName: 'Device (admin)',\n  pluralName: 'Devices (admin)',\n  querySchema: deviceListSchema,\n  listResponseSchema: createPagedListResponseSchema(deviceListItemSchema),\n  create: {\n    schema: registerDeviceAdminSchema,\n    responseSchema: registerResponseSchema,\n    description: 'Admin: register (idempotently upsert) a device on behalf of any user in the tenant.',\n  },\n})\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAChD,SAAS,YAAY;AACrB,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAEpC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,gCAAgC;AACzC,SAAS,0BAA0B,qCAAqC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAmD;AAE5D,MAAM,SAAS,aAAa,SAAS;AAIrC,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,QAAQ,YAAY;AAAA;AAAA,EAE7C,QAAQ,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,QAAQ;AAAA,IACpB,QAAQ;AAAA,IACR,cAAc;AAAA;AAAA,IAEd,eAAe;AAAA;AAAA;AAAA,IAGf,QAAQ,EAAE,SAAS,yBAAyB,IAAI,CAAC,WAAW,EAAE,OAAO,QAAQ,cAAc,KAAK,EAAE,EAAE,EAAE;AAAA;AAAA;AAAA,IAGtG,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,MAAM,OAAQ,SAAQ,UAAU,EAAE,KAAK,MAAM,OAAO;AACxD,UAAI,MAAM,SAAU,SAAQ,WAAW,EAAE,KAAK,MAAM,SAAS;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AAExB,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AAEA,UAAM,OAAO,0BAA0B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACxE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAQ1D,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,aAAa,MAAM,GAAG;AAAA,MAC1B;AAAA,MACA,EAAE,IAAI,KAAK,QAAQ,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC5D,EAAE,QAAQ,CAAC,MAAM,gBAAgB,EAAE;AAAA,IACrC;AACA,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,sCAAsC,EAAE;AAAA,QAC5F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,WAAW,kBAAkB,KAAK,CAAC,GAAG;AACxG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAKA,UAAM,eAAe,4BAA4B,MAAM;AAAA,MACrD,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,IACf,CAAsC;AAGtC,UAAM,OAA8B,EAAE,WAAW,MAAM,OAAO,gBAAgB,aAAa,SAAS,IAAI;AACxG,WAAO,MAAM,gBAAgB,MAAM,YAAY;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,KAAM,IAAI,MAAwC,SAAS,6BAA6B;AAC7G,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,qCAAqC,mCAAmC,EAAE;AAAA,QAC7F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,2BAA2B,EAAE;AAAA,MAClF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,QAAQ;AACrB,CAAC;AAEM,MAAM,UAA2B,yBAAyB;AAAA,EAC/D,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,oBAAoB;AAAA,EACtE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { toHeaderLabel } from '@open-mercato/shared/lib/crud/exporters'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { E } from '#generated/entities.ids.generated'\nimport { UserDevice } from '../../../data/entities'\nimport {\n  registerDeviceAdminSchema,\n  registerDeviceCommandSchema,\n  type RegisterDeviceCommandInput,\n} from '../../../data/validators'\nimport { resolveDeviceActorUserId } from '../../auth'\nimport { createDevicesCrudOpenApi, createPagedListResponseSchema } from '../../openapi'\nimport {\n  deviceListSchema,\n  deviceListFields,\n  deviceListSortFieldMap,\n  deviceListItemSchema,\n  deviceExportColumnFields,\n  transformDeviceListItem,\n} from '../../deviceList'\nimport { executeRegister, type DeviceMutationContext } from '../../deviceOps'\n\nconst logger = createLogger('devices')\n\n// Admin device administration: cross-user listing + register-on-behalf-of-user. Gated by devices.admin.\n// Self-serve registration/listing stays on /api/devices (scoped to the acting user).\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.admin'] },\n  POST: { requireAuth: true, requireFeatures: ['devices.admin'] },\n}\n\nexport const metadata = routeMetadata\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: UserDevice,\n    idField: 'id',\n    // organization_id stays nullable, but scoping follows the standard org-scoped pattern: the factory\n    // auto-filters by the caller's organization scope (null-aware in the query engine). Unrestricted\n    // admins see the whole tenant including null-org rows; org-restricted admins see only their orgs.\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.devices.user_device },\n  // Same cache resource tag as the self route + commands, so any device write busts both list caches.\n  events: { module: 'devices', entity: 'user_device' },\n  list: {\n    schema: deviceListSchema,\n    entityId: E.devices.user_device,\n    fields: deviceListFields,\n    sortFieldMap: deviceListSortFieldMap,\n    // The query engine projects raw column names; expose them in camelCase like every other module.\n    transformItem: transformDeviceListItem,\n    // Without an explicit column set the factory's default export spreads each item, so the deprecated\n    // snake_case aliases would double every column in the CSV/JSON/XML export.\n    export: { columns: deviceExportColumnFields.map((field) => ({ field, header: toHeaderLabel(field) })) },\n    // Tenant + org scope is enforced by the factory (orm.tenantField + orm.orgField); only the optional\n    // userId/platform narrowing is left to do here.\n    buildFilters: async (query) => {\n      const filters: Record<string, unknown> = {}\n      if (query.userId) filters.user_id = { $eq: query.userId }\n      if (query.platform) filters.platform = { $eq: query.platform }\n      return filters\n    },\n  },\n})\n\nexport const GET = crud.GET\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = registerDeviceAdminSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    // Validate the on-behalf-of target before registering. `body.userId` is caller-supplied, and the\n    // fan-out delivers by `(tenant, org, user)` \u2014 so without this an admin could register their OWN push\n    // token under an arbitrary `userId` (even a non-existent or cross-tenant one) and start receiving that\n    // user's notifications. Require a real, active user in the admin's tenant who is also within the\n    // admin's organization scope (org-restricted admins cannot reach users in orgs they can't access).\n    // Only non-encrypted columns are selected, so no decryption is needed.\n    const em = container.resolve('em') as EntityManager\n    const targetUser = await em.findOne(\n      User,\n      { id: body.userId, tenantId: auth.tenantId, deletedAt: null },\n      { fields: ['id', 'organizationId'] },\n    )\n    if (!targetUser) {\n      return NextResponse.json(\n        { error: translate('devices.errors.user_not_found', 'Target user not found in this tenant') },\n        { status: 400 },\n      )\n    }\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: targetUser.organizationId ?? null })) {\n      return NextResponse.json({ error: translate('devices.errors.forbidden', 'Access denied') }, { status: 403 })\n    }\n\n    // Register is an idempotent upsert keyed per (tenant, org, user, device). organizationId is the\n    // admin's own resolved scope, so the upsert can only ever touch a row inside an org the admin can\n    // access \u2014 no cross-org guard is needed here.\n    const commandInput = registerDeviceCommandSchema.parse({\n      ...body,\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: body.userId,\n    } satisfies RegisterDeviceCommandInput)\n\n    // actorUserId is the admin (for the mutation guard/audit); the device is owned by body.userId.\n    const mctx: DeviceMutationContext = { container, auth, scope, organizationId, actorUserId, request: req }\n    return await executeRegister(mctx, commandInput)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err) && (err.body as { code?: string } | undefined)?.code === 'device_already_registered') {\n      return NextResponse.json(\n        { error: translate('devices.errors.already_registered', 'This device is already registered') },\n        { status: 409 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.admin.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('devices.errors.register_failed', 'Failed to register device') },\n      { status: 500 },\n    )\n  }\n}\n\nconst registerResponseSchema = z.object({\n  id: z.string().uuid(),\n  deviceId: z.string(),\n  revived: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = createDevicesCrudOpenApi({\n  resourceName: 'Device (admin)',\n  pluralName: 'Devices (admin)',\n  querySchema: deviceListSchema,\n  listResponseSchema: createPagedListResponseSchema(deviceListItemSchema),\n  create: {\n    schema: registerDeviceAdminSchema,\n    responseSchema: registerResponseSchema,\n    description: 'Admin: register (idempotently upsert) a device on behalf of any user in the tenant.',\n  },\n})\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,YAAY;AACrB,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAEpC,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,gCAAgC;AACzC,SAAS,0BAA0B,qCAAqC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAmD;AAE5D,MAAM,SAAS,aAAa,SAAS;AAIrC,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAChE;AAEO,MAAM,WAAW;AAExB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA;AAAA;AAAA;AAAA,IAIT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,QAAQ,YAAY;AAAA;AAAA,EAE7C,QAAQ,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,QAAQ;AAAA,IACpB,QAAQ;AAAA,IACR,cAAc;AAAA;AAAA,IAEd,eAAe;AAAA;AAAA;AAAA,IAGf,QAAQ,EAAE,SAAS,yBAAyB,IAAI,CAAC,WAAW,EAAE,OAAO,QAAQ,cAAc,KAAK,EAAE,EAAE,EAAE;AAAA;AAAA;AAAA,IAGtG,cAAc,OAAO,UAAU;AAC7B,YAAM,UAAmC,CAAC;AAC1C,UAAI,MAAM,OAAQ,SAAQ,UAAU,EAAE,KAAK,MAAM,OAAO;AACxD,UAAI,MAAM,SAAU,SAAQ,WAAW,EAAE,KAAK,MAAM,SAAS;AAC7D,aAAO;AAAA,IACT;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AAExB,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AAEA,UAAM,OAAO,0BAA0B,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACxE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAQzE,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,aAAa,MAAM,GAAG;AAAA,MAC1B;AAAA,MACA,EAAE,IAAI,KAAK,QAAQ,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC5D,EAAE,QAAQ,CAAC,MAAM,gBAAgB,EAAE;AAAA,IACrC;AACA,QAAI,CAAC,YAAY;AACf,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,iCAAiC,sCAAsC,EAAE;AAAA,QAC5F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,WAAW,kBAAkB,KAAK,CAAC,GAAG;AACxG,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4BAA4B,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7G;AAKA,UAAM,eAAe,4BAA4B,MAAM;AAAA,MACrD,GAAG;AAAA,MACH,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ,KAAK;AAAA,IACf,CAAsC;AAGtC,UAAM,OAA8B,EAAE,WAAW,MAAM,OAAO,gBAAgB,aAAa,SAAS,IAAI;AACxG,WAAO,MAAM,gBAAgB,MAAM,YAAY;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,KAAM,IAAI,MAAwC,SAAS,6BAA6B;AAC7G,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,qCAAqC,mCAAmC,EAAE;AAAA,QAC7F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,2BAA2B,EAAE;AAAA,MAClF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,QAAQ;AACrB,CAAC;AAEM,MAAM,UAA2B,yBAAyB;AAAA,EAC/D,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,oBAAoB;AAAA,EACtE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/devices/api/route.js

@@ -5,6 +5,7 @@ import { consumeAdvancedFilterState, mergeAdvancedFilterTree } from "@open-merca
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -92,7 +93,7 @@ async function POST(req) {
     }
     const body = registerDeviceSchema.parse(await readJsonSafe(req, {}));
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
     const headerLocale = resolveLocaleFromAcceptLanguage(req.headers.get("accept-language"));
     const commandInput = registerDeviceCommandSchema.parse({
       ...body,

package/dist/modules/devices/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/devices/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveLocaleFromAcceptLanguage } from '@open-mercato/shared/lib/i18n/locale'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { E } from '#generated/entities.ids.generated'\nimport { UserDevice } from '../data/entities'\nimport {\n  registerDeviceSchema,\n  registerDeviceCommandSchema,\n  type RegisterDeviceCommandInput,\n} from '../data/validators'\nimport { resolveDeviceActorUserId } from './auth'\nimport { createDevicesCrudOpenApi, createPagedListResponseSchema } from './openapi'\nimport {\n  deviceListSchema,\n  deviceListFields,\n  deviceListSortFieldMap,\n  deviceListItemSchema,\n  transformDeviceListItem,\n} from './deviceList'\nimport { executeRegister, type DeviceMutationContext } from './deviceOps'\n\nconst logger = createLogger('devices')\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.view'] },\n  POST: { requireAuth: true, requireFeatures: ['devices.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst NO_MATCH_USER_ID = '00000000-0000-0000-0000-000000000000'\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: UserDevice,\n    idField: 'id',\n    // organization_id stays nullable, but scoping follows the standard org-scoped pattern (like every\n    // other module): the factory auto-filters by the caller's organization scope. The query engine's\n    // org scope is null-aware \u2014 callers whose scope includes null (or who have no org restriction) also\n    // see null-org rows; a caller pinned to a specific org does not.\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.devices.user_device },\n  // Align the CRUD cache resource tag with the command's resourceKind ('devices.user_device') so\n  // writes through the device commands invalidate this list cache. Without this, the factory falls\n  // back to the ORM entity name and the cache is never busted (stale list under ENABLE_CRUD_API_CACHE).\n  // The factory does not own the write methods here (custom POST + command bus), so no events are emitted.\n  events: { module: 'devices', entity: 'user_device' },\n  list: {\n    schema: deviceListSchema,\n    entityId: E.devices.user_device,\n    // push_token is a secret and is never exposed via the list API.\n    fields: deviceListFields,\n    sortFieldMap: deviceListSortFieldMap,\n    // The query engine projects raw column names; expose them in camelCase like every other module.\n    transformItem: transformDeviceListItem,\n    // Exports are off for the self-serve list. The factory enables them for every list that does not\n    // declare `export` (resolveAvailableExportFormats falls back to csv/json/xml/markdown), and its\n    // full-export branch replaces the filters with `{}` instead of calling `buildFilters`\n    // (`baseFilters = exportFullRequested ? {} : buildFilters(...)`). On this route `buildFilters` is\n    // the only user-level boundary \u2014 automatic scoping covers tenant and organization, not the acting\n    // user \u2014 so `?format=json&exportScope=full` would return every device in the caller's org scope.\n    // With no available formats, `exportRequested` is never true and that branch is unreachable. Bulk\n    // device data belongs to the admin tree (api/admin/devices), which gates cross-user listing.\n    export: { enabled: false },\n    // Self-serve: always scoped to the acting user. Cross-user listing lives in api/admin/devices.\n    buildFilters: async (query, ctx) => {\n      // Consume the client-supplied advanced filter here (this deletes every `filter[...]` key from\n      // `query`) so the CRUD factory's own merge step becomes a no-op. That step is\n      // `{ ...existingFilters, ...advancedWhere }` (advanced-filter-integration.ts), and condition\n      // field names are never validated \u2014 `filter[conditions][0][field]=user_id` or `=$and` would\n      // otherwise overwrite whatever key this route uses for its scope and widen the listing to other\n      // users. `mergeAdvancedFilterTree` instead AND-combines under `$and: [routeFilters, treeWhere]`,\n      // where the scope sits in its own array element and no client key can reach it. Same pattern as\n      // customers/people, companies and deals.\n      const advancedFilterTree = consumeAdvancedFilterState(query)\n      const filters: Record<string, unknown> = {}\n      const actorUserId = resolveDeviceActorUserId(ctx.auth)\n      // Self-serve visibility is strictly the acting user's own devices; cross-user listing lives in\n      // api/admin/devices. Fail closed when there is no resolvable acting user (e.g. API keys).\n      filters.user_id = { $eq: actorUserId ?? NO_MATCH_USER_ID }\n      if (query.platform) filters.platform = { $eq: query.platform }\n      return mergeAdvancedFilterTree(filters, advancedFilterTree)\n    },\n  },\n})\n\nexport const GET = crud.GET\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = registerDeviceSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n    // When the app doesn't send an explicit per-device locale, fall back to the request's\n    // Accept-Language (the mobile client calls this with its own headers). Only on self-register \u2014\n    // PUT stays tri-state, and admin register uses the admin's browser headers, not the device's.\n    const headerLocale = resolveLocaleFromAcceptLanguage(req.headers.get('accept-language'))\n\n    const commandInput = registerDeviceCommandSchema.parse({\n      ...body,\n      locale: body.locale ?? headerLocale ?? undefined,\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n    } satisfies RegisterDeviceCommandInput)\n\n    const mctx: DeviceMutationContext = { container, auth, scope, organizationId, actorUserId, request: req }\n    return await executeRegister(mctx, commandInput)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err) && (err.body as { code?: string } | undefined)?.code === 'device_already_registered') {\n      return NextResponse.json(\n        { error: translate('devices.errors.already_registered', 'This device is already registered') },\n        { status: 409 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('devices.errors.register_failed', 'Failed to register device') },\n      { status: 500 },\n    )\n  }\n}\n\nconst registerResponseSchema = z.object({\n  id: z.string().uuid(),\n  deviceId: z.string(),\n  revived: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = createDevicesCrudOpenApi({\n  resourceName: 'Device',\n  pluralName: 'Devices',\n  querySchema: deviceListSchema,\n  listResponseSchema: createPagedListResponseSchema(deviceListItemSchema),\n  create: {\n    schema: registerDeviceSchema,\n    responseSchema: registerResponseSchema,\n    description:\n      'Registers (or idempotently upserts) the current user\\'s device for the given deviceId. May include an initial push token.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B,+BAA+B;AACpE,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,uCAAuC;AAEhD,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,gCAAgC;AACzC,SAAS,0BAA0B,qCAAqC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAmD;AAE5D,MAAM,SAAS,aAAa,SAAS;AAErC,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEO,MAAM,WAAW;AAExB,MAAM,mBAAmB;AAEzB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,QAAQ,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,QAAQ;AAAA;AAAA,IAEpB,QAAQ;AAAA,IACR,cAAc;AAAA;AAAA,IAEd,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASf,QAAQ,EAAE,SAAS,MAAM;AAAA;AAAA,IAEzB,cAAc,OAAO,OAAO,QAAQ;AASlC,YAAM,qBAAqB,2BAA2B,KAAK;AAC3D,YAAM,UAAmC,CAAC;AAC1C,YAAM,cAAc,yBAAyB,IAAI,IAAI;AAGrD,cAAQ,UAAU,EAAE,KAAK,eAAe,iBAAiB;AACzD,UAAI,MAAM,SAAU,SAAQ,WAAW,EAAE,KAAK,MAAM,SAAS;AAC7D,aAAO,wBAAwB,SAAS,kBAAkB;AAAA,IAC5D;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AAExB,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AAEA,UAAM,OAAO,qBAAqB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACnE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAK1D,UAAM,eAAe,gCAAgC,IAAI,QAAQ,IAAI,iBAAiB,CAAC;AAEvF,UAAM,eAAe,4BAA4B,MAAM;AAAA,MACrD,GAAG;AAAA,MACH,QAAQ,KAAK,UAAU,gBAAgB;AAAA,MACvC,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV,CAAsC;AAEtC,UAAM,OAA8B,EAAE,WAAW,MAAM,OAAO,gBAAgB,aAAa,SAAS,IAAI;AACxG,WAAO,MAAM,gBAAgB,MAAM,YAAY;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,KAAM,IAAI,MAAwC,SAAS,6BAA6B;AAC7G,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,qCAAqC,mCAAmC,EAAE;AAAA,QAC7F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,2BAA2B,EAAE;AAAA,MAClF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,QAAQ;AACrB,CAAC;AAEM,MAAM,UAA2B,yBAAyB;AAAA,EAC/D,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,oBAAoB;AAAA,EACtE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'\nimport { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveLocaleFromAcceptLanguage } from '@open-mercato/shared/lib/i18n/locale'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { E } from '#generated/entities.ids.generated'\nimport { UserDevice } from '../data/entities'\nimport {\n  registerDeviceSchema,\n  registerDeviceCommandSchema,\n  type RegisterDeviceCommandInput,\n} from '../data/validators'\nimport { resolveDeviceActorUserId } from './auth'\nimport { createDevicesCrudOpenApi, createPagedListResponseSchema } from './openapi'\nimport {\n  deviceListSchema,\n  deviceListFields,\n  deviceListSortFieldMap,\n  deviceListItemSchema,\n  transformDeviceListItem,\n} from './deviceList'\nimport { executeRegister, type DeviceMutationContext } from './deviceOps'\n\nconst logger = createLogger('devices')\n\nconst routeMetadata = {\n  GET: { requireAuth: true, requireFeatures: ['devices.view'] },\n  POST: { requireAuth: true, requireFeatures: ['devices.manage'] },\n}\n\nexport const metadata = routeMetadata\n\nconst NO_MATCH_USER_ID = '00000000-0000-0000-0000-000000000000'\n\nconst crud = makeCrudRoute({\n  metadata: routeMetadata,\n  orm: {\n    entity: UserDevice,\n    idField: 'id',\n    // organization_id stays nullable, but scoping follows the standard org-scoped pattern (like every\n    // other module): the factory auto-filters by the caller's organization scope. The query engine's\n    // org scope is null-aware \u2014 callers whose scope includes null (or who have no org restriction) also\n    // see null-org rows; a caller pinned to a specific org does not.\n    orgField: 'organizationId',\n    tenantField: 'tenantId',\n    softDeleteField: 'deletedAt',\n  },\n  indexer: { entityType: E.devices.user_device },\n  // Align the CRUD cache resource tag with the command's resourceKind ('devices.user_device') so\n  // writes through the device commands invalidate this list cache. Without this, the factory falls\n  // back to the ORM entity name and the cache is never busted (stale list under ENABLE_CRUD_API_CACHE).\n  // The factory does not own the write methods here (custom POST + command bus), so no events are emitted.\n  events: { module: 'devices', entity: 'user_device' },\n  list: {\n    schema: deviceListSchema,\n    entityId: E.devices.user_device,\n    // push_token is a secret and is never exposed via the list API.\n    fields: deviceListFields,\n    sortFieldMap: deviceListSortFieldMap,\n    // The query engine projects raw column names; expose them in camelCase like every other module.\n    transformItem: transformDeviceListItem,\n    // Exports are off for the self-serve list. The factory enables them for every list that does not\n    // declare `export` (resolveAvailableExportFormats falls back to csv/json/xml/markdown), and its\n    // full-export branch replaces the filters with `{}` instead of calling `buildFilters`\n    // (`baseFilters = exportFullRequested ? {} : buildFilters(...)`). On this route `buildFilters` is\n    // the only user-level boundary \u2014 automatic scoping covers tenant and organization, not the acting\n    // user \u2014 so `?format=json&exportScope=full` would return every device in the caller's org scope.\n    // With no available formats, `exportRequested` is never true and that branch is unreachable. Bulk\n    // device data belongs to the admin tree (api/admin/devices), which gates cross-user listing.\n    export: { enabled: false },\n    // Self-serve: always scoped to the acting user. Cross-user listing lives in api/admin/devices.\n    buildFilters: async (query, ctx) => {\n      // Consume the client-supplied advanced filter here (this deletes every `filter[...]` key from\n      // `query`) so the CRUD factory's own merge step becomes a no-op. That step is\n      // `{ ...existingFilters, ...advancedWhere }` (advanced-filter-integration.ts), and condition\n      // field names are never validated \u2014 `filter[conditions][0][field]=user_id` or `=$and` would\n      // otherwise overwrite whatever key this route uses for its scope and widen the listing to other\n      // users. `mergeAdvancedFilterTree` instead AND-combines under `$and: [routeFilters, treeWhere]`,\n      // where the scope sits in its own array element and no client key can reach it. Same pattern as\n      // customers/people, companies and deals.\n      const advancedFilterTree = consumeAdvancedFilterState(query)\n      const filters: Record<string, unknown> = {}\n      const actorUserId = resolveDeviceActorUserId(ctx.auth)\n      // Self-serve visibility is strictly the acting user's own devices; cross-user listing lives in\n      // api/admin/devices. Fail closed when there is no resolvable acting user (e.g. API keys).\n      filters.user_id = { $eq: actorUserId ?? NO_MATCH_USER_ID }\n      if (query.platform) filters.platform = { $eq: query.platform }\n      return mergeAdvancedFilterTree(filters, advancedFilterTree)\n    },\n  },\n})\n\nexport const GET = crud.GET\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const actorUserId = resolveDeviceActorUserId(auth)\n    if (!auth || !auth.tenantId || !actorUserId) {\n      return NextResponse.json({ error: translate('devices.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n    }\n\n    const body = registerDeviceSchema.parse(await readJsonSafe(req, {}))\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n    // When the app doesn't send an explicit per-device locale, fall back to the request's\n    // Accept-Language (the mobile client calls this with its own headers). Only on self-register \u2014\n    // PUT stays tri-state, and admin register uses the admin's browser headers, not the device's.\n    const headerLocale = resolveLocaleFromAcceptLanguage(req.headers.get('accept-language'))\n\n    const commandInput = registerDeviceCommandSchema.parse({\n      ...body,\n      locale: body.locale ?? headerLocale ?? undefined,\n      tenantId: auth.tenantId,\n      organizationId,\n      userId: actorUserId,\n    } satisfies RegisterDeviceCommandInput)\n\n    const mctx: DeviceMutationContext = { container, auth, scope, organizationId, actorUserId, request: req }\n    return await executeRegister(mctx, commandInput)\n  } catch (err) {\n    if (err instanceof z.ZodError) {\n      return NextResponse.json(\n        { error: translate('devices.errors.invalid_payload', 'Invalid device payload'), details: err.flatten() },\n        { status: 400 },\n      )\n    }\n    if (isCrudHttpError(err) && (err.body as { code?: string } | undefined)?.code === 'device_already_registered') {\n      return NextResponse.json(\n        { error: translate('devices.errors.already_registered', 'This device is already registered') },\n        { status: 409 },\n      )\n    }\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('devices.POST failed', { err })\n    return NextResponse.json(\n      { error: translate('devices.errors.register_failed', 'Failed to register device') },\n      { status: 500 },\n    )\n  }\n}\n\nconst registerResponseSchema = z.object({\n  id: z.string().uuid(),\n  deviceId: z.string(),\n  revived: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = createDevicesCrudOpenApi({\n  resourceName: 'Device',\n  pluralName: 'Devices',\n  querySchema: deviceListSchema,\n  listResponseSchema: createPagedListResponseSchema(deviceListItemSchema),\n  create: {\n    schema: registerDeviceSchema,\n    responseSchema: registerResponseSchema,\n    description:\n      'Registers (or idempotently upserts) the current user\\'s device for the given deviceId. May include an initial push token.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B,+BAA+B;AACpE,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,uCAAuC;AAEhD,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,gCAAgC;AACzC,SAAS,0BAA0B,qCAAqC;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAmD;AAE5D,MAAM,SAAS,aAAa,SAAS;AAErC,MAAM,gBAAgB;AAAA,EACpB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC5D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEO,MAAM,WAAW;AAExB,MAAM,mBAAmB;AAEzB,MAAM,OAAO,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,KAAK;AAAA,IACH,QAAQ;AAAA,IACR,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,iBAAiB;AAAA,EACnB;AAAA,EACA,SAAS,EAAE,YAAY,EAAE,QAAQ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAK7C,QAAQ,EAAE,QAAQ,WAAW,QAAQ,cAAc;AAAA,EACnD,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU,EAAE,QAAQ;AAAA;AAAA,IAEpB,QAAQ;AAAA,IACR,cAAc;AAAA;AAAA,IAEd,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASf,QAAQ,EAAE,SAAS,MAAM;AAAA;AAAA,IAEzB,cAAc,OAAO,OAAO,QAAQ;AASlC,YAAM,qBAAqB,2BAA2B,KAAK;AAC3D,YAAM,UAAmC,CAAC;AAC1C,YAAM,cAAc,yBAAyB,IAAI,IAAI;AAGrD,cAAQ,UAAU,EAAE,KAAK,eAAe,iBAAiB;AACzD,UAAI,MAAM,SAAU,SAAQ,WAAW,EAAE,KAAK,MAAM,SAAS;AAC7D,aAAO,wBAAwB,SAAS,kBAAkB;AAAA,IAC5D;AAAA,EACF;AACF,CAAC;AAEM,MAAM,MAAM,KAAK;AAExB,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,cAAc,yBAAyB,IAAI;AACjD,QAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,aAAa;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,+BAA+B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AAEA,UAAM,OAAO,qBAAqB,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACnE,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAKzE,UAAM,eAAe,gCAAgC,IAAI,QAAQ,IAAI,iBAAiB,CAAC;AAEvF,UAAM,eAAe,4BAA4B,MAAM;AAAA,MACrD,GAAG;AAAA,MACH,QAAQ,KAAK,UAAU,gBAAgB;AAAA,MACvC,UAAU,KAAK;AAAA,MACf;AAAA,MACA,QAAQ;AAAA,IACV,CAAsC;AAEtC,UAAM,OAA8B,EAAE,WAAW,MAAM,OAAO,gBAAgB,aAAa,SAAS,IAAI;AACxG,WAAO,MAAM,gBAAgB,MAAM,YAAY;AAAA,EACjD,SAAS,KAAK;AACZ,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,kCAAkC,wBAAwB,GAAG,SAAS,IAAI,QAAQ,EAAE;AAAA,QACvG,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,KAAM,IAAI,MAAwC,SAAS,6BAA6B;AAC7G,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,qCAAqC,mCAAmC,EAAE;AAAA,QAC7F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,kCAAkC,2BAA2B,EAAE;AAAA,MAClF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,SAAS,EAAE,QAAQ;AACrB,CAAC;AAEM,MAAM,UAA2B,yBAAyB;AAAA,EAC/D,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,oBAAoB,8BAA8B,oBAAoB;AAAA,EACtE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,aACE;AAAA,EACJ;AACF,CAAC;",
   "names": []
 }

package/dist/modules/dictionaries/api/[dictionaryId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/dictionaries/api/%5BdictionaryId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryIdParamsSchema,\n  dictionaryUpdateSchema,\n  upsertDictionarySchema,\n} from '../openapi'\nimport { dictionaryKeySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'api' })\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n// System dictionaries use namespaced keys (e.g. `sales.deal_loss_reason`,\n// `resources.activity-types`) that the strict create-key regex rejects. The\n// manager edit dialog disables the key field but still resubmits the existing\n// key, so the update parse must accept any stored key verbatim. The strict\n// user-key regex is only enforced below when the key actually changes.\nconst updateKeySchema = z.string().trim().min(1).max(100)\nconst updateSchema = upsertDictionarySchema\n  .partial()\n  .extend({ key: updateKeySchema.optional() })\n  .refine((data) => Object.keys(data).length > 0, {\n    message: 'Provide at least one field to update.',\n  })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nfunction isProtectedCurrencyDictionary(dictionary: Dictionary) {\n  const key = dictionary.key?.trim().toLowerCase() ?? ''\n  return key === 'currency' || key === 'currencies'\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      organizationId: dictionary.organizationId,\n      isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to load dictionary', { err })\n    return NextResponse.json({ error: 'Failed to load dictionary' }, { status: 500 })\n  }\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = updateSchema.parse(await req.json().catch(() => ({})))\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    await enforceCommandOptimisticLockWithGuards(context.container, {\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n      if (payload.isActive === false) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n    }\n\n    if (payload.key) {\n      const key = payload.key.trim().toLowerCase()\n      if (key !== dictionary.key) {\n        const strictKey = dictionaryKeySchema.safeParse(key)\n        if (!strictKey.success) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.invalid_key', 'Use lowercase letters, numbers, hyphen, or underscore.') })\n        }\n        const organizationId = context.organizationId\n        if (!organizationId) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n        }\n        const existing = await context.em.findOne(Dictionary, {\n          key,\n          organizationId,\n          tenantId: context.tenantId,\n          deletedAt: null,\n        })\n        if (existing) {\n          throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n        }\n        dictionary.key = key\n      }\n    }\n\n    if (payload.name) {\n      dictionary.name = payload.name.trim()\n    }\n    if (payload.description !== undefined) {\n      dictionary.description = payload.description ? payload.description.trim() : null\n    }\n    if (payload.isActive !== undefined) {\n      dictionary.isActive = Boolean(payload.isActive)\n      if (!dictionary.isActive) {\n        dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n      } else {\n        dictionary.deletedAt = null\n      }\n    }\n    if (payload.entrySortMode !== undefined) {\n      dictionary.entrySortMode = payload.entrySortMode\n    }\n\n    dictionary.updatedAt = new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: err.issues[0]?.message ?? 'Validation failed' }, { status: 400 })\n    }\n    logger.error('Failed to update dictionary', { err })\n    return NextResponse.json({ error: 'Failed to update dictionary' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    await enforceCommandOptimisticLockWithGuards(context.container, {\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n    }\n\n    dictionary.isActive = false\n    dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to delete dictionary', { err })\n    return NextResponse.json({ error: 'Failed to delete dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionaryGetDoc: OpenApiMethodDoc = {\n  summary: 'Get dictionary',\n  description: 'Returns details for the specified dictionary, including inheritance flags.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary details.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary',\n  description: 'Updates mutable attributes of the dictionary. Currency dictionaries are protected from modification.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dictionaryUpdateSchema,\n    description: 'Fields to update on the dictionary.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary updated.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or protected dictionary', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary',\n  description: 'Soft deletes the dictionary unless it is the protected currency dictionary.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary archived.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Protected dictionary cannot be deleted', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary resource',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryGetDoc,\n    PATCH: dictionaryPatchDoc,\n    DELETE: dictionaryDeleteDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8CAA8C;AACvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAEtE,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAMjE,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,MAAM,eAAe,uBAClB,QAAQ,EACR,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,EAC1C,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,EAC9C,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,SAAS,8BAA8B,YAAwB;AAC7D,QAAM,MAAM,WAAW,KAAK,KAAK,EAAE,YAAY,KAAK;AACpD,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,gBAAgB,WAAW;AAAA,MAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,MAC7F,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAsB,MAAM,KAAc,KAA6C;AACrF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,aAAa,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AACrE,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,UAAM,uCAAuC,QAAQ,WAAW;AAAA,MAC9D,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,UAAI,QAAQ,OAAO,QAAQ,IAAI,KAAK,EAAE,YAAY,MAAM,WAAW,KAAK;AACtE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AACA,UAAI,QAAQ,aAAa,OAAO;AAC9B,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AAAA,IACF;AAEA,QAAI,QAAQ,KAAK;AACf,YAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,UAAI,QAAQ,WAAW,KAAK;AAC1B,cAAM,YAAY,oBAAoB,UAAU,GAAG;AACnD,YAAI,CAAC,UAAU,SAAS;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,wDAAwD,EAAE,CAAC;AAAA,QACxJ;AACA,cAAM,iBAAiB,QAAQ;AAC/B,YAAI,CAAC,gBAAgB;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,QAC5I;AACA,cAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,UACpD;AAAA,UACA;AAAA,UACA,UAAU,QAAQ;AAAA,UAClB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,UAAU;AACZ,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,QACzI;AACA,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM;AAChB,iBAAW,OAAO,QAAQ,KAAK,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,iBAAW,cAAc,QAAQ,cAAc,QAAQ,YAAY,KAAK,IAAI;AAAA,IAC9E;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,iBAAW,WAAW,QAAQ,QAAQ,QAAQ;AAC9C,UAAI,CAAC,WAAW,UAAU;AACxB,mBAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AAAA,MAC1D,OAAO;AACL,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,QAAW;AACvC,iBAAW,gBAAgB,QAAQ;AAAA,IACrC;AAEA,eAAW,YAAY,oBAAI,KAAK;AAChC,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,WAAW,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,OAAO,KAAc,KAA6C;AACtF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,UAAM,uCAAuC,QAAQ,WAAW;AAAA,MAC9D,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,IAC/J;AAEA,eAAW,WAAW;AACtB,eAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AACxD,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,mBAAqC;AAAA,EACzC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,wBAAwB;AAAA,EAC3F;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,wBAAwB;AAAA,IACzG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,qBAAqB;AAAA,EACnF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,wBAAwB;AAAA,IACtG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesOkSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryIdParamsSchema,\n  dictionaryUpdateSchema,\n  upsertDictionarySchema,\n} from '../openapi'\nimport { dictionaryKeySchema } from '@open-mercato/core/modules/dictionaries/data/validators'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'api' })\n\nconst paramsSchema = z.object({ dictionaryId: z.string().uuid() })\n// The manager edit dialog disables the key field but still resubmits the existing key, so the\n// update parse accepts any stored key verbatim \u2014 a row written before the current key rule can\n// still be renamed or edited. The strict key schema is enforced below only when the key changes.\nconst updateKeySchema = z.string().trim().min(1).max(100)\nconst updateSchema = upsertDictionarySchema\n  .partial()\n  .extend({ key: updateKeySchema.optional() })\n  .refine((data) => Object.keys(data).length > 0, {\n    message: 'Provide at least one field to update.',\n  })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nfunction isProtectedCurrencyDictionary(dictionary: Dictionary) {\n  const key = dictionary.key?.trim().toLowerCase() ?? ''\n  return key === 'currency' || key === 'currencies'\n}\n\nasync function loadDictionary(\n  context: Awaited<ReturnType<typeof resolveDictionariesRouteContext>>,\n  id: string,\n  options: { allowInherited?: boolean } = {},\n) {\n  const { allowInherited = false } = options\n  if (!allowInherited && !context.organizationId) {\n    throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n  }\n  const baseFilter = {\n    id,\n    tenantId: context.tenantId,\n    deletedAt: null,\n  }\n  const filter = allowInherited\n    ? {\n        ...baseFilter,\n        ...(context.readableOrganizationIds.length\n          ? { organizationId: { $in: context.readableOrganizationIds } }\n          : {}),\n      }\n    : {\n        ...baseFilter,\n        organizationId: context.organizationId,\n      }\n  const dictionary = await context.em.findOne(Dictionary, filter)\n  if (!dictionary) {\n    throw new CrudHttpError(404, { error: context.translate('dictionaries.errors.not_found', 'Dictionary not found') })\n  }\n  return dictionary\n}\n\nexport async function GET(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId, { allowInherited: true })\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      organizationId: dictionary.organizationId,\n      isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to load dictionary', { err })\n    return NextResponse.json({ error: 'Failed to load dictionary' }, { status: 500 })\n  }\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const payload = updateSchema.parse(await req.json().catch(() => ({})))\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    await enforceCommandOptimisticLockWithGuards(context.container, {\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      if (payload.key && payload.key.trim().toLowerCase() !== dictionary.key) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n      if (payload.isActive === false) {\n        throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n      }\n    }\n\n    if (payload.key) {\n      const key = payload.key.trim().toLowerCase()\n      if (key !== dictionary.key) {\n        const strictKey = dictionaryKeySchema.safeParse(key)\n        if (!strictKey.success) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.invalid_key', 'Use lowercase letters, numbers, hyphen, or underscore.') })\n        }\n        const organizationId = context.organizationId\n        if (!organizationId) {\n          throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n        }\n        const existing = await context.em.findOne(Dictionary, {\n          key,\n          organizationId,\n          tenantId: context.tenantId,\n          deletedAt: null,\n        })\n        if (existing) {\n          throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n        }\n        dictionary.key = key\n      }\n    }\n\n    if (payload.name) {\n      dictionary.name = payload.name.trim()\n    }\n    if (payload.description !== undefined) {\n      dictionary.description = payload.description ? payload.description.trim() : null\n    }\n    if (payload.isActive !== undefined) {\n      dictionary.isActive = Boolean(payload.isActive)\n      if (!dictionary.isActive) {\n        dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n      } else {\n        dictionary.deletedAt = null\n      }\n    }\n    if (payload.entrySortMode !== undefined) {\n      dictionary.entrySortMode = payload.entrySortMode\n    }\n\n    dictionary.updatedAt = new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      managerVisibility: dictionary.managerVisibility,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: err.issues[0]?.message ?? 'Validation failed' }, { status: 400 })\n    }\n    logger.error('Failed to update dictionary', { err })\n    return NextResponse.json({ error: 'Failed to update dictionary' }, { status: 500 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { dictionaryId?: string } }) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const { dictionaryId } = paramsSchema.parse({ dictionaryId: ctx.params?.dictionaryId })\n    const dictionary = await loadDictionary(context, dictionaryId)\n\n    await enforceCommandOptimisticLockWithGuards(context.container, {\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      current: dictionary.updatedAt ?? null,\n      request: req,\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    if (isProtectedCurrencyDictionary(dictionary)) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.currency_protected', 'The currency dictionary cannot be modified or deleted.') })\n    }\n\n    dictionary.isActive = false\n    dictionary.deletedAt = dictionary.deletedAt ?? new Date()\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to delete dictionary', { err })\n    return NextResponse.json({ error: 'Failed to delete dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionaryGetDoc: OpenApiMethodDoc = {\n  summary: 'Get dictionary',\n  description: 'Returns details for the specified dictionary, including inheritance flags.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary details.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid parameters', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update dictionary',\n  description: 'Updates mutable attributes of the dictionary. Currency dictionaries are protected from modification.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dictionaryUpdateSchema,\n    description: 'Fields to update on the dictionary.',\n  },\n  responses: [\n    { status: 200, description: 'Dictionary updated.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or protected dictionary', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to update dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionaryDeleteDoc: OpenApiMethodDoc = {\n  summary: 'Delete dictionary',\n  description: 'Soft deletes the dictionary unless it is the protected currency dictionary.',\n  tags: [dictionariesTag],\n  responses: [\n    { status: 200, description: 'Dictionary archived.', schema: dictionariesOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Protected dictionary cannot be deleted', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 404, description: 'Dictionary not found', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to delete dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionary resource',\n  pathParams: dictionaryIdParamsSchema,\n  methods: {\n    GET: dictionaryGetDoc,\n    PATCH: dictionaryPatchDoc,\n    DELETE: dictionaryDeleteDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C,SAAS,8CAA8C;AACvD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAEtE,MAAM,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAIjE,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,MAAM,eAAe,uBAClB,QAAQ,EACR,OAAO,EAAE,KAAK,gBAAgB,SAAS,EAAE,CAAC,EAC1C,OAAO,CAAC,SAAS,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,EAC9C,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AAAA,EACrE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACxE;AAEA,SAAS,8BAA8B,YAAwB;AAC7D,QAAM,MAAM,WAAW,KAAK,KAAK,EAAE,YAAY,KAAK;AACpD,SAAO,QAAQ,cAAc,QAAQ;AACvC;AAEA,eAAe,eACb,SACA,IACA,UAAwC,CAAC,GACzC;AACA,QAAM,EAAE,iBAAiB,MAAM,IAAI;AACnC,MAAI,CAAC,kBAAkB,CAAC,QAAQ,gBAAgB;AAC9C,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,EAC5I;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,EACb;AACA,QAAM,SAAS,iBACX;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,wBAAwB,SAChC,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAAA,EACP,IACA;AAAA,IACE,GAAG;AAAA,IACH,gBAAgB,QAAQ;AAAA,EAC1B;AACJ,QAAM,aAAa,MAAM,QAAQ,GAAG,QAAQ,YAAY,MAAM;AAC9D,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,sBAAsB,EAAE,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc,KAA6C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,cAAc,EAAE,gBAAgB,KAAK,CAAC;AACvF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,gBAAgB,WAAW;AAAA,MAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,MAC7F,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,6BAA6B,EAAE,IAAI,CAAC;AACjD,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACF;AAEA,eAAsB,MAAM,KAAc,KAA6C;AACrF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,UAAU,aAAa,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AACrE,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,UAAM,uCAAuC,QAAQ,WAAW;AAAA,MAC9D,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,UAAI,QAAQ,OAAO,QAAQ,IAAI,KAAK,EAAE,YAAY,MAAM,WAAW,KAAK;AACtE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AACA,UAAI,QAAQ,aAAa,OAAO;AAC9B,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,MAC/J;AAAA,IACF;AAEA,QAAI,QAAQ,KAAK;AACf,YAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,UAAI,QAAQ,WAAW,KAAK;AAC1B,cAAM,YAAY,oBAAoB,UAAU,GAAG;AACnD,YAAI,CAAC,UAAU,SAAS;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,mCAAmC,wDAAwD,EAAE,CAAC;AAAA,QACxJ;AACA,cAAM,iBAAiB,QAAQ;AAC/B,YAAI,CAAC,gBAAgB;AACnB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,QAC5I;AACA,cAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,UACpD;AAAA,UACA;AAAA,UACA,UAAU,QAAQ;AAAA,UAClB,WAAW;AAAA,QACb,CAAC;AACD,YAAI,UAAU;AACZ,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,QACzI;AACA,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM;AAChB,iBAAW,OAAO,QAAQ,KAAK,KAAK;AAAA,IACtC;AACA,QAAI,QAAQ,gBAAgB,QAAW;AACrC,iBAAW,cAAc,QAAQ,cAAc,QAAQ,YAAY,KAAK,IAAI;AAAA,IAC9E;AACA,QAAI,QAAQ,aAAa,QAAW;AAClC,iBAAW,WAAW,QAAQ,QAAQ,QAAQ;AAC9C,UAAI,CAAC,WAAW,UAAU;AACxB,mBAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AAAA,MAC1D,OAAO;AACL,mBAAW,YAAY;AAAA,MACzB;AAAA,IACF;AACA,QAAI,QAAQ,kBAAkB,QAAW;AACvC,iBAAW,gBAAgB,QAAQ;AAAA,IACrC;AAEA,eAAW,YAAY,oBAAI,KAAK;AAChC,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,mBAAmB,WAAW;AAAA,MAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,WAAW,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,OAAO,KAAc,KAA6C;AACtF,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,EAAE,aAAa,IAAI,aAAa,MAAM,EAAE,cAAc,IAAI,QAAQ,aAAa,CAAC;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS,YAAY;AAE7D,UAAM,uCAAuC,QAAQ,WAAW;AAAA,MAC9D,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW,aAAa;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,QAAI,8BAA8B,UAAU,GAAG;AAC7C,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,wDAAwD,EAAE,CAAC;AAAA,IAC/J;AAEA,eAAW,WAAW;AACtB,eAAW,YAAY,WAAW,aAAa,oBAAI,KAAK;AACxD,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,mBAAqC;AAAA,EACzC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,wBAAwB;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,wBAAwB;AAAA,EAC3F;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,wBAAwB;AAAA,IACzG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,qBAAqB;AAAA,EACnF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,wBAAwB;AAAA,IACtG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,wBAAwB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,KAAK;AAAA,IACL,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/api/context.js

@@ -2,6 +2,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { createLogger } from "@open-mercato/shared/lib/logger";
@@ -22,7 +23,7 @@ async function resolveDictionariesRouteContext(req) {
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
   const em = container.resolve("em");
   const tenantId = scope?.tenantId ?? auth.tenantId;
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   const normalizeId = (value) => {
     if (typeof value !== "string") return null;
     const trimmed = value.trim();

package/dist/modules/dictionaries/api/context.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dictionaries/api/context.ts"],
-  "sourcesContent": ["import { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'context' })\n\nexport type DictionariesRouteContext = {\n  container: AwilixContainer\n  ctx: CommandRuntimeContext\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>\n  em: EntityManager\n  organizationId: string | null\n  tenantId: string\n  readableOrganizationIds: string[]\n  translate: (key: string, fallback?: string) => string\n}\n\nexport function resolveDictionaryActorId(\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>,\n): string {\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function resolveDictionariesRouteContext(req: Request): Promise<DictionariesRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('dictionaries.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = (container.resolve('em') as EntityManager)\n  const tenantId: string = scope?.tenantId ?? auth.tenantId\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n  const normalizeId = (value: unknown): string | null => {\n    if (typeof value !== 'string') return null\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n\n  const candidateIds = new Set<string>()\n  const pushCandidate = (value: unknown) => {\n    const normalized = normalizeId(value)\n    if (normalized) candidateIds.add(normalized)\n  }\n\n  pushCandidate(organizationId)\n  if (Array.isArray(scope?.filterIds)) {\n    for (const id of scope.filterIds) pushCandidate(id)\n  }\n  if (Array.isArray(scope?.allowedIds)) {\n    for (const id of scope.allowedIds) pushCandidate(id)\n  }\n  pushCandidate(auth.orgId ?? null)\n\n  const readableOrganizationIds = new Set<string>()\n  try {\n    const shouldLoadAll = candidateIds.size === 0\n    const organizations = await em.find(\n      Organization,\n      {\n        tenant: tenantId as any,\n        deletedAt: null,\n        ...(shouldLoadAll ? {} : { id: { $in: Array.from(candidateIds) } }),\n      } as any,\n      { fields: ['id', 'ancestorIds'] },\n    )\n    for (const organization of organizations) {\n      const id = normalizeId(organization.id)\n      if (id) readableOrganizationIds.add(id)\n      if (Array.isArray(organization.ancestorIds)) {\n        for (const ancestorId of organization.ancestorIds) {\n          const normalized = normalizeId(ancestorId)\n          if (normalized) readableOrganizationIds.add(normalized)\n        }\n      }\n    }\n    if (!shouldLoadAll && readableOrganizationIds.size === 0) {\n      for (const id of candidateIds) readableOrganizationIds.add(id)\n    }\n  } catch (err) {\n    logger.warn('Failed to resolve readable organizations', { err })\n    for (const id of candidateIds) readableOrganizationIds.add(id)\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    container,\n    ctx,\n    auth,\n    em,\n    organizationId,\n    tenantId,\n    readableOrganizationIds: Array.from(readableOrganizationIds),\n    translate,\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAI9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAanE,SAAS,yBACd,MACQ;AACR,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,gCAAgC,KAAiD;AACrG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,cAAc,EAAE,CAAC;AAAA,EACvG;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,WAAmB,OAAO,YAAY,KAAK;AACjD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAM,cAAc,CAAC,UAAkC;AACrD,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,gBAAgB,CAAC,UAAmB;AACxC,UAAM,aAAa,YAAY,KAAK;AACpC,QAAI,WAAY,cAAa,IAAI,UAAU;AAAA,EAC7C;AAEA,gBAAc,cAAc;AAC5B,MAAI,MAAM,QAAQ,OAAO,SAAS,GAAG;AACnC,eAAW,MAAM,MAAM,UAAW,eAAc,EAAE;AAAA,EACpD;AACA,MAAI,MAAM,QAAQ,OAAO,UAAU,GAAG;AACpC,eAAW,MAAM,MAAM,WAAY,eAAc,EAAE;AAAA,EACrD;AACA,gBAAc,KAAK,SAAS,IAAI;AAEhC,QAAM,0BAA0B,oBAAI,IAAY;AAChD,MAAI;AACF,UAAM,gBAAgB,aAAa,SAAS;AAC5C,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,GAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,YAAY,EAAE,EAAE;AAAA,MACnE;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,aAAa,EAAE;AAAA,IAClC;AACA,eAAW,gBAAgB,eAAe;AACxC,YAAM,KAAK,YAAY,aAAa,EAAE;AACtC,UAAI,GAAI,yBAAwB,IAAI,EAAE;AACtC,UAAI,MAAM,QAAQ,aAAa,WAAW,GAAG;AAC3C,mBAAW,cAAc,aAAa,aAAa;AACjD,gBAAM,aAAa,YAAY,UAAU;AACzC,cAAI,WAAY,yBAAwB,IAAI,UAAU;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,wBAAwB,SAAS,GAAG;AACxD,iBAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,IAC/D;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,4CAA4C,EAAE,IAAI,CAAC;AAC/D,eAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,EAC/D;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,MAAM,KAAK,uBAAuB;AAAA,IAC3D;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'context' })\n\nexport type DictionariesRouteContext = {\n  container: AwilixContainer\n  ctx: CommandRuntimeContext\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>\n  em: EntityManager\n  organizationId: string | null\n  tenantId: string\n  readableOrganizationIds: string[]\n  translate: (key: string, fallback?: string) => string\n}\n\nexport function resolveDictionaryActorId(\n  auth: Awaited<ReturnType<typeof getAuthFromRequest>>,\n): string {\n  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function resolveDictionariesRouteContext(req: Request): Promise<DictionariesRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('dictionaries.errors.unauthorized', 'Unauthorized') })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = (container.resolve('em') as EntityManager)\n  const tenantId: string = scope?.tenantId ?? auth.tenantId\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n  const normalizeId = (value: unknown): string | null => {\n    if (typeof value !== 'string') return null\n    const trimmed = value.trim()\n    return trimmed.length > 0 ? trimmed : null\n  }\n\n  const candidateIds = new Set<string>()\n  const pushCandidate = (value: unknown) => {\n    const normalized = normalizeId(value)\n    if (normalized) candidateIds.add(normalized)\n  }\n\n  pushCandidate(organizationId)\n  if (Array.isArray(scope?.filterIds)) {\n    for (const id of scope.filterIds) pushCandidate(id)\n  }\n  if (Array.isArray(scope?.allowedIds)) {\n    for (const id of scope.allowedIds) pushCandidate(id)\n  }\n  pushCandidate(auth.orgId ?? null)\n\n  const readableOrganizationIds = new Set<string>()\n  try {\n    const shouldLoadAll = candidateIds.size === 0\n    const organizations = await em.find(\n      Organization,\n      {\n        tenant: tenantId as any,\n        deletedAt: null,\n        ...(shouldLoadAll ? {} : { id: { $in: Array.from(candidateIds) } }),\n      } as any,\n      { fields: ['id', 'ancestorIds'] },\n    )\n    for (const organization of organizations) {\n      const id = normalizeId(organization.id)\n      if (id) readableOrganizationIds.add(id)\n      if (Array.isArray(organization.ancestorIds)) {\n        for (const ancestorId of organization.ancestorIds) {\n          const normalized = normalizeId(ancestorId)\n          if (normalized) readableOrganizationIds.add(normalized)\n        }\n      }\n    }\n    if (!shouldLoadAll && readableOrganizationIds.size === 0) {\n      for (const id of candidateIds) readableOrganizationIds.add(id)\n    }\n  } catch (err) {\n    logger.warn('Failed to resolve readable organizations', { err })\n    for (const id of candidateIds) readableOrganizationIds.add(id)\n  }\n\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    container,\n    ctx,\n    auth,\n    em,\n    organizationId,\n    tenantId,\n    readableOrganizationIds: Array.from(readableOrganizationIds),\n    translate,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB;AAI9B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAanE,SAAS,yBACd,MACQ;AACR,MAAI,QAAQ,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACpF,MAAI,QAAQ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC1F,MAAI,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AACxF,SAAO;AACT;AAEA,eAAsB,gCAAgC,KAAiD;AACrG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,oCAAoC,cAAc,EAAE,CAAC;AAAA,EACvG;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,QAAM,WAAmB,OAAO,YAAY,KAAK;AACjD,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAM,cAAc,CAAC,UAAkC;AACrD,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,gBAAgB,CAAC,UAAmB;AACxC,UAAM,aAAa,YAAY,KAAK;AACpC,QAAI,WAAY,cAAa,IAAI,UAAU;AAAA,EAC7C;AAEA,gBAAc,cAAc;AAC5B,MAAI,MAAM,QAAQ,OAAO,SAAS,GAAG;AACnC,eAAW,MAAM,MAAM,UAAW,eAAc,EAAE;AAAA,EACpD;AACA,MAAI,MAAM,QAAQ,OAAO,UAAU,GAAG;AACpC,eAAW,MAAM,MAAM,WAAY,eAAc,EAAE;AAAA,EACrD;AACA,gBAAc,KAAK,SAAS,IAAI;AAEhC,QAAM,0BAA0B,oBAAI,IAAY;AAChD,MAAI;AACF,UAAM,gBAAgB,aAAa,SAAS;AAC5C,UAAM,gBAAgB,MAAM,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,GAAI,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,YAAY,EAAE,EAAE;AAAA,MACnE;AAAA,MACA,EAAE,QAAQ,CAAC,MAAM,aAAa,EAAE;AAAA,IAClC;AACA,eAAW,gBAAgB,eAAe;AACxC,YAAM,KAAK,YAAY,aAAa,EAAE;AACtC,UAAI,GAAI,yBAAwB,IAAI,EAAE;AACtC,UAAI,MAAM,QAAQ,aAAa,WAAW,GAAG;AAC3C,mBAAW,cAAc,aAAa,aAAa;AACjD,gBAAM,aAAa,YAAY,UAAU;AACzC,cAAI,WAAY,yBAAwB,IAAI,UAAU;AAAA,QACxD;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB,wBAAwB,SAAS,GAAG;AACxD,iBAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,IAC/D;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,KAAK,4CAA4C,EAAE,IAAI,CAAC;AAC/D,eAAW,MAAM,aAAc,yBAAwB,IAAI,EAAE;AAAA,EAC/D;AAEA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,MAAM,KAAK,uBAAuB;AAAA,IAC3D;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/dictionaries/api/route.js

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { z } from "zod";
 import { Dictionary } from "@open-mercato/core/modules/dictionaries/data/entities";
 import { resolveDictionariesRouteContext, resolveDictionaryActorId } from "@open-mercato/core/modules/dictionaries/api/context";
 import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
@@ -140,6 +141,9 @@ async function POST(req) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: err.issues[0]?.message ?? "[internal] Validation failed" }, { status: 400 });
+    }
     logger.error("Failed to create dictionary", { err });
     return NextResponse.json({ error: "Failed to create dictionary" }, { status: 500 });
   }

package/dist/modules/dictionaries/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dictionaries/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryListQuerySchema,\n  dictionaryListResponseSchema,\n  upsertDictionarySchema,\n} from './openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'api' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const url = new URL(req.url)\n    const includeInactive = parseBooleanToken(url.searchParams.get('includeInactive')) === true\n\n    const organizationFilter = context.readableOrganizationIds.length\n      ? { organizationId: { $in: context.readableOrganizationIds } }\n      : {}\n\n    const items = await context.em.find(\n      Dictionary,\n      {\n        ...organizationFilter,\n        tenantId: context.tenantId,\n        deletedAt: null,\n        ...(includeInactive ? {} : { isActive: true }),\n      },\n      { orderBy: { name: 'asc' } },\n    )\n\n    return NextResponse.json({\n      items: items.map((dictionary) => ({\n        id: dictionary.id,\n        key: dictionary.key,\n        name: dictionary.name,\n        description: dictionary.description,\n        isSystem: dictionary.isSystem,\n        isActive: dictionary.isActive,\n        managerVisibility: dictionary.managerVisibility,\n        entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n        organizationId: dictionary.organizationId,\n        isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n        createdAt: dictionary.createdAt,\n        updatedAt: dictionary.updatedAt,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to load dictionaries', { err })\n    return NextResponse.json({ error: 'Failed to load dictionaries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const payload = upsertDictionarySchema.parse(await req.json().catch(() => ({})))\n    const key = payload.key.trim().toLowerCase()\n    if (!context.organizationId) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n    }\n\n    const existing = await context.em.findOne(Dictionary, {\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      key,\n      deletedAt: null,\n    })\n    if (existing) {\n      throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n    }\n\n    const dictionary = context.em.create(Dictionary, {\n      key,\n      name: payload.name.trim(),\n      description: payload.description?.trim() || null,\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      isSystem: payload.isSystem ?? false,\n      isActive: payload.isActive ?? true,\n      managerVisibility: 'default',\n      entrySortMode: payload.entrySortMode ?? DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    context.em.persist(dictionary)\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to create dictionary', { err })\n    return NextResponse.json({ error: 'Failed to create dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionariesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionaries',\n  description: 'Returns dictionaries accessible to the current organization, optionally including inactive records.',\n  tags: [dictionariesTag],\n  query: dictionaryListQuerySchema,\n  responses: [\n    { status: 200, description: 'Dictionary collection.', schema: dictionaryListResponseSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionaries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionariesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary',\n  description: 'Registers a dictionary scoped to the current organization.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: upsertDictionarySchema,\n    description: 'Dictionary definition including unique key and display name.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary created.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionaries collection',\n  methods: {\n    GET: dictionariesGetDoc,\n    POST: dictionariesPostDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE/D,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,kBAAkB,kBAAkB,IAAI,aAAa,IAAI,iBAAiB,CAAC,MAAM;AAEvF,UAAM,qBAAqB,QAAQ,wBAAwB,SACvD,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAEL,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,WAAW;AAAA,QACX,GAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC9C;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE;AAAA,IAC7B;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,IAAI,CAAC,gBAAgB;AAAA,QAChC,IAAI,WAAW;AAAA,QACf,KAAK,WAAW;AAAA,QAChB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,QACxB,UAAU,WAAW;AAAA,QACrB,UAAU,WAAW;AAAA,QACrB,mBAAmB,WAAW;AAAA,QAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,QACtE,gBAAgB,WAAW;AAAA,QAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,QAC7F,WAAW,WAAW;AAAA,QACtB,WAAW,WAAW;AAAA,MACxB,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,UAAU,uBAAuB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC/E,UAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,IAC5I;AAEA,UAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,MACpD,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,IACzI;AAEA,UAAM,aAAa,QAAQ,GAAG,OAAO,YAAY;AAAA,MAC/C;AAAA,MACA,MAAM,QAAQ,KAAK,KAAK;AAAA,MACxB,aAAa,QAAQ,aAAa,KAAK,KAAK;AAAA,MAC5C,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,mBAAmB;AAAA,MACnB,eAAe,QAAQ,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,YAAQ,GAAG,QAAQ,UAAU;AAC7B,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,6BAA6B;AAAA,EAC7F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { Dictionary } from '@open-mercato/core/modules/dictionaries/data/entities'\nimport { resolveDictionariesRouteContext, resolveDictionaryActorId } from '@open-mercato/core/modules/dictionaries/api/context'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n  resolveDictionaryEntrySortMode,\n} from '@open-mercato/core/modules/dictionaries/lib/entrySort'\nimport {\n  dictionariesErrorSchema,\n  dictionariesTag,\n  dictionaryDetailSchema,\n  dictionaryListQuerySchema,\n  dictionaryListResponseSchema,\n  upsertDictionarySchema,\n} from './openapi'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('dictionaries').child({ component: 'api' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dictionaries.view'] },\n  POST: { requireAuth: true, requireFeatures: ['dictionaries.manage'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const url = new URL(req.url)\n    const includeInactive = parseBooleanToken(url.searchParams.get('includeInactive')) === true\n\n    const organizationFilter = context.readableOrganizationIds.length\n      ? { organizationId: { $in: context.readableOrganizationIds } }\n      : {}\n\n    const items = await context.em.find(\n      Dictionary,\n      {\n        ...organizationFilter,\n        tenantId: context.tenantId,\n        deletedAt: null,\n        ...(includeInactive ? {} : { isActive: true }),\n      },\n      { orderBy: { name: 'asc' } },\n    )\n\n    return NextResponse.json({\n      items: items.map((dictionary) => ({\n        id: dictionary.id,\n        key: dictionary.key,\n        name: dictionary.name,\n        description: dictionary.description,\n        isSystem: dictionary.isSystem,\n        isActive: dictionary.isActive,\n        managerVisibility: dictionary.managerVisibility,\n        entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n        organizationId: dictionary.organizationId,\n        isInherited: context.organizationId ? dictionary.organizationId !== context.organizationId : false,\n        createdAt: dictionary.createdAt,\n        updatedAt: dictionary.updatedAt,\n      })),\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Failed to load dictionaries', { err })\n    return NextResponse.json({ error: 'Failed to load dictionaries' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveDictionariesRouteContext(req)\n    const payload = upsertDictionarySchema.parse(await req.json().catch(() => ({})))\n    const key = payload.key.trim().toLowerCase()\n    if (!context.organizationId) {\n      throw new CrudHttpError(400, { error: context.translate('dictionaries.errors.organization_required', 'Organization context is required') })\n    }\n\n    const existing = await context.em.findOne(Dictionary, {\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      key,\n      deletedAt: null,\n    })\n    if (existing) {\n      throw new CrudHttpError(409, { error: context.translate('dictionaries.errors.duplicate', 'A dictionary with this key already exists') })\n    }\n\n    const dictionary = context.em.create(Dictionary, {\n      key,\n      name: payload.name.trim(),\n      description: payload.description?.trim() || null,\n      organizationId: context.organizationId,\n      tenantId: context.tenantId,\n      isSystem: payload.isSystem ?? false,\n      isActive: payload.isActive ?? true,\n      managerVisibility: 'default',\n      entrySortMode: payload.entrySortMode ?? DEFAULT_DICTIONARY_ENTRY_SORT_MODE,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n\n    const guardUserId = resolveDictionaryActorId(context.auth)\n    const guardResult = await validateCrudMutationGuard(context.container, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: guardUserId,\n      resourceKind: 'dictionaries.dictionary',\n      resourceId: dictionary.id,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    context.em.persist(dictionary)\n    await context.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(context.container, {\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        userId: guardUserId,\n        resourceKind: 'dictionaries.dictionary',\n        resourceId: dictionary.id,\n        operation: 'create',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    return NextResponse.json({\n      id: dictionary.id,\n      key: dictionary.key,\n      name: dictionary.name,\n      description: dictionary.description,\n      isSystem: dictionary.isSystem,\n      isActive: dictionary.isActive,\n      entrySortMode: resolveDictionaryEntrySortMode(dictionary.entrySortMode),\n      createdAt: dictionary.createdAt,\n      updatedAt: dictionary.updatedAt,\n    }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: err.issues[0]?.message ?? '[internal] Validation failed' }, { status: 400 })\n    }\n    logger.error('Failed to create dictionary', { err })\n    return NextResponse.json({ error: 'Failed to create dictionary' }, { status: 500 })\n  }\n}\n\nconst dictionariesGetDoc: OpenApiMethodDoc = {\n  summary: 'List dictionaries',\n  description: 'Returns dictionaries accessible to the current organization, optionally including inactive records.',\n  tags: [dictionariesTag],\n  query: dictionaryListQuerySchema,\n  responses: [\n    { status: 200, description: 'Dictionary collection.', schema: dictionaryListResponseSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to load dictionaries', schema: dictionariesErrorSchema },\n  ],\n}\n\nconst dictionariesPostDoc: OpenApiMethodDoc = {\n  summary: 'Create dictionary',\n  description: 'Registers a dictionary scoped to the current organization.',\n  tags: [dictionariesTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: upsertDictionarySchema,\n    description: 'Dictionary definition including unique key and display name.',\n  },\n  responses: [\n    { status: 201, description: 'Dictionary created.', schema: dictionaryDetailSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: dictionariesErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dictionariesErrorSchema },\n    { status: 409, description: 'Dictionary key already exists', schema: dictionariesErrorSchema },\n    { status: 500, description: 'Failed to create dictionary', schema: dictionariesErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dictionariesTag,\n  summary: 'Dictionaries collection',\n  methods: {\n    GET: dictionariesGetDoc,\n    POST: dictionariesPostDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC,gCAAgC;AAC1E,SAAS,eAAe,uBAAuB;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,cAAc,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE/D,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AAAA,EACjE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,qBAAqB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,kBAAkB,kBAAkB,IAAI,aAAa,IAAI,iBAAiB,CAAC,MAAM;AAEvF,UAAM,qBAAqB,QAAQ,wBAAwB,SACvD,EAAE,gBAAgB,EAAE,KAAK,QAAQ,wBAAwB,EAAE,IAC3D,CAAC;AAEL,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,GAAG;AAAA,QACH,UAAU,QAAQ;AAAA,QAClB,WAAW;AAAA,QACX,GAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,KAAK;AAAA,MAC9C;AAAA,MACA,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE;AAAA,IAC7B;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,IAAI,CAAC,gBAAgB;AAAA,QAChC,IAAI,WAAW;AAAA,QACf,KAAK,WAAW;AAAA,QAChB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,QACxB,UAAU,WAAW;AAAA,QACrB,UAAU,WAAW;AAAA,QACrB,mBAAmB,WAAW;AAAA,QAC9B,eAAe,+BAA+B,WAAW,aAAa;AAAA,QACtE,gBAAgB,WAAW;AAAA,QAC3B,aAAa,QAAQ,iBAAiB,WAAW,mBAAmB,QAAQ,iBAAiB;AAAA,QAC7F,WAAW,WAAW;AAAA,QACtB,WAAW,WAAW;AAAA,MACxB,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,gCAAgC,GAAG;AACzD,UAAM,UAAU,uBAAuB,MAAM,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,CAAC;AAC/E,UAAM,MAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,6CAA6C,kCAAkC,EAAE,CAAC;AAAA,IAC5I;AAEA,UAAM,WAAW,MAAM,QAAQ,GAAG,QAAQ,YAAY;AAAA,MACpD,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,iCAAiC,2CAA2C,EAAE,CAAC;AAAA,IACzI;AAEA,UAAM,aAAa,QAAQ,GAAG,OAAO,YAAY;AAAA,MAC/C;AAAA,MACA,MAAM,QAAQ,KAAK,KAAK;AAAA,MACxB,aAAa,QAAQ,aAAa,KAAK,KAAK;AAAA,MAC5C,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ,YAAY;AAAA,MAC9B,UAAU,QAAQ,YAAY;AAAA,MAC9B,mBAAmB;AAAA,MACnB,eAAe,QAAQ,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AAED,UAAM,cAAc,yBAAyB,QAAQ,IAAI;AACzD,UAAM,cAAc,MAAM,0BAA0B,QAAQ,WAAW;AAAA,MACrE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY,WAAW;AAAA,MACvB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,YAAQ,GAAG,QAAQ,UAAU;AAC7B,UAAM,QAAQ,GAAG,MAAM;AAEvB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,QAAQ,WAAW;AAAA,QACxD,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,WAAW;AAAA,QACvB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,MAAM,WAAW;AAAA,MACjB,aAAa,WAAW;AAAA,MACxB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,eAAe,+BAA+B,WAAW,aAAa;AAAA,MACtE,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,IACxB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,WAAW,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,WAAO,MAAM,+BAA+B,EAAE,IAAI,CAAC;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACF;AAEA,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,6BAA6B;AAAA,EAC7F;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,uBAAuB;AAAA,EACpF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,wBAAwB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,wBAAwB;AAAA,IACvF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,wBAAwB;AAAA,IAC7F,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,wBAAwB;AAAA,EAC7F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
   "names": []
 }