@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/dist/modules/staff/lib/timesheets-ui/CalendarPicker.js

@@ -3,8 +3,12 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { IconButton } from "@open-mercato/ui/primitives/icon-button";
-import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { useOptionalLocale, useT } from "@open-mercato/shared/lib/i18n/context";
 import { CalendarDays, ChevronLeft, ChevronRight } from "lucide-react";
+function resolveToday(today) {
+  if (typeof today === "function") return new Date(today());
+  return today ? new Date(today) : /* @__PURE__ */ new Date();
+}
 function getMonday(date) {
   const result = new Date(date);
   const day = result.getDay();
@@ -41,21 +45,22 @@ function buildWeeks(year, month) {
   }
   return weeks;
 }
-function getLocalizedDayHeaders() {
+function getLocalizedDayHeaders(locale) {
   const baseMonday = new Date(2024, 0, 1);
   return Array.from({ length: 7 }, (_, idx) => {
     const date = new Date(baseMonday);
     date.setDate(date.getDate() + idx);
-    return date.toLocaleDateString(void 0, { weekday: "narrow" });
+    return date.toLocaleDateString(locale, { weekday: "narrow" });
   });
 }
-function CalendarPicker({ selectedWeekStart, onWeekSelect }) {
+function CalendarPicker({ selectedWeekStart, onWeekSelect, today: todayProp }) {
   const t = useT();
+  const locale = useOptionalLocale();
   const [open, setOpen] = React.useState(false);
   const [viewYear, setViewYear] = React.useState(selectedWeekStart.getFullYear());
   const [viewMonth, setViewMonth] = React.useState(selectedWeekStart.getMonth());
   const containerRef = React.useRef(null);
-  const dayHeaders = React.useMemo(() => getLocalizedDayHeaders(), []);
+  const dayHeaders = React.useMemo(() => getLocalizedDayHeaders(locale), [locale]);
   React.useEffect(() => {
     function handleClickOutside(event) {
       if (containerRef.current && !containerRef.current.contains(event.target)) {
@@ -71,9 +76,9 @@ function CalendarPicker({ selectedWeekStart, onWeekSelect }) {
   }, [selectedWeekStart]);
   const weeks = React.useMemo(() => buildWeeks(viewYear, viewMonth), [viewYear, viewMonth]);
   const monthLabel = React.useMemo(() => {
-    return new Date(viewYear, viewMonth, 1).toLocaleString(void 0, { month: "long", year: "numeric" });
-  }, [viewYear, viewMonth]);
-  const today = React.useMemo(() => /* @__PURE__ */ new Date(), []);
+    return new Date(viewYear, viewMonth, 1).toLocaleString(locale, { month: "long", year: "numeric" });
+  }, [locale, viewYear, viewMonth]);
+  const today = resolveToday(todayProp);
   const handleWeekClick = React.useCallback((monday) => {
     onWeekSelect(monday);
     setOpen(false);
@@ -117,7 +122,7 @@ function CalendarPicker({ selectedWeekStart, onWeekSelect }) {
             variant: "ghost",
             size: "sm",
             className: "h-auto px-2 py-1 text-xs",
-            onClick: () => handleWeekClick(getMonday(/* @__PURE__ */ new Date())),
+            onClick: () => handleWeekClick(getMonday(resolveToday(todayProp))),
             children: t("staff.timesheets.my.calendar.thisWeek", "This week")
           }
         ),
@@ -129,7 +134,7 @@ function CalendarPicker({ selectedWeekStart, onWeekSelect }) {
             size: "sm",
             className: "h-auto px-2 py-1 text-xs",
             onClick: () => {
-              const lastWeek = /* @__PURE__ */ new Date();
+              const lastWeek = resolveToday(todayProp);
               lastWeek.setDate(lastWeek.getDate() - 7);
               handleWeekClick(getMonday(lastWeek));
             },

package/dist/modules/staff/lib/timesheets-ui/CalendarPicker.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/staff/lib/timesheets-ui/CalendarPicker.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CalendarDays, ChevronLeft, ChevronRight } from 'lucide-react'\n\ntype CalendarPickerProps = {\n  selectedWeekStart: Date\n  onWeekSelect: (weekStart: Date) => void\n}\n\nfunction getMonday(date: Date): Date {\n  const result = new Date(date)\n  const day = result.getDay()\n  const diff = day === 0 ? -6 : 1 - day\n  result.setDate(result.getDate() + diff)\n  result.setHours(0, 0, 0, 0)\n  return result\n}\n\nfunction getWeekNumber(date: Date): number {\n  const target = new Date(Date.UTC(date.getFullYear(), date.getMonth(), date.getDate()))\n  target.setUTCDate(target.getUTCDate() + 4 - (target.getUTCDay() || 7))\n  const yearStart = new Date(Date.UTC(target.getUTCFullYear(), 0, 1))\n  return Math.ceil(((target.getTime() - yearStart.getTime()) / 86400000 + 1) / 7)\n}\n\nfunction isSameDay(first: Date, second: Date): boolean {\n  return first.getFullYear() === second.getFullYear() && first.getMonth() === second.getMonth() && first.getDate() === second.getDate()\n}\n\nfunction isSameWeek(first: Date, second: Date): boolean {\n  return isSameDay(getMonday(first), getMonday(second))\n}\n\nfunction buildWeeks(year: number, month: number): Date[][] {\n  const firstDay = new Date(year, month, 1)\n  const start = getMonday(firstDay)\n  const weeks: Date[][] = []\n  const current = new Date(start)\n\n  for (let weekIdx = 0; weekIdx < 6; weekIdx++) {\n    const week: Date[] = []\n    for (let dayIdx = 0; dayIdx < 7; dayIdx++) {\n      week.push(new Date(current))\n      current.setDate(current.getDate() + 1)\n    }\n    weeks.push(week)\n    if (current.getMonth() !== month && weekIdx >= 3) break\n  }\n  return weeks\n}\n\nfunction getLocalizedDayHeaders(): string[] {\n  const baseMonday = new Date(2024, 0, 1) // Known Monday\n  return Array.from({ length: 7 }, (_, idx) => {\n    const date = new Date(baseMonday)\n    date.setDate(date.getDate() + idx)\n    return date.toLocaleDateString(undefined, { weekday: 'narrow' })\n  })\n}\n\nexport function CalendarPicker({ selectedWeekStart, onWeekSelect }: CalendarPickerProps) {\n  const t = useT()\n  const [open, setOpen] = React.useState(false)\n  const [viewYear, setViewYear] = React.useState(selectedWeekStart.getFullYear())\n  const [viewMonth, setViewMonth] = React.useState(selectedWeekStart.getMonth())\n  const containerRef = React.useRef<HTMLDivElement>(null)\n\n  const dayHeaders = React.useMemo(() => getLocalizedDayHeaders(), [])\n\n  React.useEffect(() => {\n    function handleClickOutside(event: MouseEvent) {\n      if (containerRef.current && !containerRef.current.contains(event.target as Node)) {\n        setOpen(false)\n      }\n    }\n    if (open) document.addEventListener('mousedown', handleClickOutside)\n    return () => document.removeEventListener('mousedown', handleClickOutside)\n  }, [open])\n\n  React.useEffect(() => {\n    setViewYear(selectedWeekStart.getFullYear())\n    setViewMonth(selectedWeekStart.getMonth())\n  }, [selectedWeekStart])\n\n  const weeks = React.useMemo(() => buildWeeks(viewYear, viewMonth), [viewYear, viewMonth])\n\n  const monthLabel = React.useMemo(() => {\n    return new Date(viewYear, viewMonth, 1).toLocaleString(undefined, { month: 'long', year: 'numeric' })\n  }, [viewYear, viewMonth])\n\n  const today = React.useMemo(() => new Date(), [])\n\n  const handleWeekClick = React.useCallback((monday: Date) => {\n    onWeekSelect(monday)\n    setOpen(false)\n  }, [onWeekSelect])\n\n  const goToPrevMonth = React.useCallback(() => {\n    setViewMonth((prev) => {\n      if (prev === 0) { setViewYear((yr) => yr - 1); return 11 }\n      return prev - 1\n    })\n  }, [])\n\n  const goToNextMonth = React.useCallback(() => {\n    setViewMonth((prev) => {\n      if (prev === 11) { setViewYear((yr) => yr + 1); return 0 }\n      return prev + 1\n    })\n  }, [])\n\n  return (\n    <div ref={containerRef} className=\"relative inline-block\">\n      <IconButton\n        variant=\"outline\"\n        size=\"sm\"\n        type=\"button\"\n        onClick={() => setOpen((prev) => !prev)}\n        aria-label={t('staff.timesheets.my.calendar.open', 'Open calendar')}\n      >\n        <CalendarDays className=\"size-4\" />\n      </IconButton>\n\n      {open && (\n        <div className=\"absolute left-0 z-20 mt-1 w-[280px] rounded-lg border bg-popover p-3 shadow-lg\">\n          {/* Quick links */}\n          <div className=\"mb-3 flex gap-2 border-b pb-2\">\n            <Button\n              type=\"button\"\n              variant=\"ghost\"\n              size=\"sm\"\n              className=\"h-auto px-2 py-1 text-xs\"\n              onClick={() => handleWeekClick(getMonday(new Date()))}\n            >\n              {t('staff.timesheets.my.calendar.thisWeek', 'This week')}\n            </Button>\n            <Button\n              type=\"button\"\n              variant=\"ghost\"\n              size=\"sm\"\n              className=\"h-auto px-2 py-1 text-xs\"\n              onClick={() => {\n                const lastWeek = new Date()\n                lastWeek.setDate(lastWeek.getDate() - 7)\n                handleWeekClick(getMonday(lastWeek))\n              }}\n            >\n              {t('staff.timesheets.my.calendar.lastWeek', 'Last week')}\n            </Button>\n          </div>\n\n          {/* Month navigation */}\n          <div className=\"mb-2 flex items-center justify-between\">\n            <IconButton\n              variant=\"ghost\"\n              size=\"xs\"\n              type=\"button\"\n              onClick={goToPrevMonth}\n              aria-label={t('staff.timesheets.my.calendar.prevMonth', 'Previous month')}\n            >\n              <ChevronLeft className=\"size-3.5\" />\n            </IconButton>\n            <span className=\"text-sm font-medium\">{monthLabel}</span>\n            <IconButton\n              variant=\"ghost\"\n              size=\"xs\"\n              type=\"button\"\n              onClick={goToNextMonth}\n              aria-label={t('staff.timesheets.my.calendar.nextMonth', 'Next month')}\n            >\n              <ChevronRight className=\"size-3.5\" />\n            </IconButton>\n          </div>\n\n          {/* Day headers */}\n          <div className=\"grid grid-cols-[32px_repeat(7,1fr)] gap-0 mb-1\">\n            <div />\n            {dayHeaders.map((day, idx) => (\n              <div key={idx} className=\"text-center text-[11px] font-medium text-muted-foreground py-1\">\n                {day}\n              </div>\n            ))}\n          </div>\n\n          {/* Week rows */}\n          {weeks.map((week) => {\n            const monday = week[0]\n            const weekNum = getWeekNumber(monday)\n            const isSelected = isSameWeek(monday, selectedWeekStart)\n\n            return (\n              <Button\n                key={monday.toISOString()}\n                type=\"button\"\n                variant=\"ghost\"\n                className={`grid grid-cols-[32px_repeat(7,1fr)] gap-0 w-full h-auto rounded-md px-0 py-0 hover:bg-muted\n                  ${isSelected ? 'bg-primary text-primary-foreground hover:bg-primary/90' : ''}`}\n                onClick={() => handleWeekClick(monday)}\n              >\n                <span className={`text-[10px] font-medium py-1.5 text-center ${isSelected ? 'text-primary-foreground/70' : 'text-muted-foreground'}`}>\n                  {weekNum}\n                </span>\n                {week.map((date) => {\n                  const inMonth = date.getMonth() === viewMonth\n                  const isTodayDate = isSameDay(date, today)\n                  return (\n                    <span\n                      key={date.toISOString()}\n                      className={`text-xs py-1.5 text-center\n                        ${!inMonth && !isSelected ? 'text-muted-foreground/40' : ''}\n                        ${isTodayDate && !isSelected ? 'font-bold text-primary' : ''}\n                        ${isTodayDate && isSelected ? 'font-bold underline' : ''}`}\n                    >\n                      {date.getDate()}\n                    </span>\n                  )\n                })}\n              </Button>\n            )\n          })}\n        </div>\n      )}\n    </div>\n  )\n}\n"],
-  "mappings": ";AA4HQ,cAME,YANF;AA1HR,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,YAAY;AACrB,SAAS,cAAc,aAAa,oBAAoB;AAOxD,SAAS,UAAU,MAAkB;AACnC,QAAM,SAAS,IAAI,KAAK,IAAI;AAC5B,QAAM,MAAM,OAAO,OAAO;AAC1B,QAAM,OAAO,QAAQ,IAAI,KAAK,IAAI;AAClC,SAAO,QAAQ,OAAO,QAAQ,IAAI,IAAI;AACtC,SAAO,SAAS,GAAG,GAAG,GAAG,CAAC;AAC1B,SAAO;AACT;AAEA,SAAS,cAAc,MAAoB;AACzC,QAAM,SAAS,IAAI,KAAK,KAAK,IAAI,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,CAAC,CAAC;AACrF,SAAO,WAAW,OAAO,WAAW,IAAI,KAAK,OAAO,UAAU,KAAK,EAAE;AACrE,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,OAAO,eAAe,GAAG,GAAG,CAAC,CAAC;AAClE,SAAO,KAAK,OAAO,OAAO,QAAQ,IAAI,UAAU,QAAQ,KAAK,QAAW,KAAK,CAAC;AAChF;AAEA,SAAS,UAAU,OAAa,QAAuB;AACrD,SAAO,MAAM,YAAY,MAAM,OAAO,YAAY,KAAK,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK,MAAM,QAAQ,MAAM,OAAO,QAAQ;AACtI;AAEA,SAAS,WAAW,OAAa,QAAuB;AACtD,SAAO,UAAU,UAAU,KAAK,GAAG,UAAU,MAAM,CAAC;AACtD;AAEA,SAAS,WAAW,MAAc,OAAyB;AACzD,QAAM,WAAW,IAAI,KAAK,MAAM,OAAO,CAAC;AACxC,QAAM,QAAQ,UAAU,QAAQ;AAChC,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAU,IAAI,KAAK,KAAK;AAE9B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,OAAe,CAAC;AACtB,aAAS,SAAS,GAAG,SAAS,GAAG,UAAU;AACzC,WAAK,KAAK,IAAI,KAAK,OAAO,CAAC;AAC3B,cAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACvC;AACA,UAAM,KAAK,IAAI;AACf,QAAI,QAAQ,SAAS,MAAM,SAAS,WAAW,EAAG;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,yBAAmC;AAC1C,QAAM,aAAa,IAAI,KAAK,MAAM,GAAG,CAAC;AACtC,SAAO,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,QAAQ;AAC3C,UAAM,OAAO,IAAI,KAAK,UAAU;AAChC,SAAK,QAAQ,KAAK,QAAQ,IAAI,GAAG;AACjC,WAAO,KAAK,mBAAmB,QAAW,EAAE,SAAS,SAAS,CAAC;AAAA,EACjE,CAAC;AACH;AAEO,SAAS,eAAe,EAAE,mBAAmB,aAAa,GAAwB;AACvF,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,kBAAkB,YAAY,CAAC;AAC9E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,kBAAkB,SAAS,CAAC;AAC7E,QAAM,eAAe,MAAM,OAAuB,IAAI;AAEtD,QAAM,aAAa,MAAM,QAAQ,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEnE,QAAM,UAAU,MAAM;AACpB,aAAS,mBAAmB,OAAmB;AAC7C,UAAI,aAAa,WAAW,CAAC,aAAa,QAAQ,SAAS,MAAM,MAAc,GAAG;AAChF,gBAAQ,KAAK;AAAA,MACf;AAAA,IACF;AACA,QAAI,KAAM,UAAS,iBAAiB,aAAa,kBAAkB;AACnE,WAAO,MAAM,SAAS,oBAAoB,aAAa,kBAAkB;AAAA,EAC3E,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,UAAU,MAAM;AACpB,gBAAY,kBAAkB,YAAY,CAAC;AAC3C,iBAAa,kBAAkB,SAAS,CAAC;AAAA,EAC3C,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,QAAQ,MAAM,QAAQ,MAAM,WAAW,UAAU,SAAS,GAAG,CAAC,UAAU,SAAS,CAAC;AAExF,QAAM,aAAa,MAAM,QAAQ,MAAM;AACrC,WAAO,IAAI,KAAK,UAAU,WAAW,CAAC,EAAE,eAAe,QAAW,EAAE,OAAO,QAAQ,MAAM,UAAU,CAAC;AAAA,EACtG,GAAG,CAAC,UAAU,SAAS,CAAC;AAExB,QAAM,QAAQ,MAAM,QAAQ,MAAM,oBAAI,KAAK,GAAG,CAAC,CAAC;AAEhD,QAAM,kBAAkB,MAAM,YAAY,CAAC,WAAiB;AAC1D,iBAAa,MAAM;AACnB,YAAQ,KAAK;AAAA,EACf,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,iBAAa,CAAC,SAAS;AACrB,UAAI,SAAS,GAAG;AAAE,oBAAY,CAAC,OAAO,KAAK,CAAC;AAAG,eAAO;AAAA,MAAG;AACzD,aAAO,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,iBAAa,CAAC,SAAS;AACrB,UAAI,SAAS,IAAI;AAAE,oBAAY,CAAC,OAAO,KAAK,CAAC;AAAG,eAAO;AAAA,MAAE;AACzD,aAAO,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,SACE,qBAAC,SAAI,KAAK,cAAc,WAAU,yBAChC;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI;AAAA,QACtC,cAAY,EAAE,qCAAqC,eAAe;AAAA,QAElE,8BAAC,gBAAa,WAAU,UAAS;AAAA;AAAA,IACnC;AAAA,IAEC,QACC,qBAAC,SAAI,WAAU,kFAEb;AAAA,2BAAC,SAAI,WAAU,iCACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,gBAAgB,UAAU,oBAAI,KAAK,CAAC,CAAC;AAAA,YAEnD,YAAE,yCAAyC,WAAW;AAAA;AAAA,QACzD;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM;AACb,oBAAM,WAAW,oBAAI,KAAK;AAC1B,uBAAS,QAAQ,SAAS,QAAQ,IAAI,CAAC;AACvC,8BAAgB,UAAU,QAAQ,CAAC;AAAA,YACrC;AAAA,YAEC,YAAE,yCAAyC,WAAW;AAAA;AAAA,QACzD;AAAA,SACF;AAAA,MAGA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,MAAK;AAAA,YACL,SAAS;AAAA,YACT,cAAY,EAAE,0CAA0C,gBAAgB;AAAA,YAExE,8BAAC,eAAY,WAAU,YAAW;AAAA;AAAA,QACpC;AAAA,QACA,oBAAC,UAAK,WAAU,uBAAuB,sBAAW;AAAA,QAClD;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,MAAK;AAAA,YACL,SAAS;AAAA,YACT,cAAY,EAAE,0CAA0C,YAAY;AAAA,YAEpE,8BAAC,gBAAa,WAAU,YAAW;AAAA;AAAA,QACrC;AAAA,SACF;AAAA,MAGA,qBAAC,SAAI,WAAU,kDACb;AAAA,4BAAC,SAAI;AAAA,QACJ,WAAW,IAAI,CAAC,KAAK,QACpB,oBAAC,SAAc,WAAU,kEACtB,iBADO,GAEV,CACD;AAAA,SACH;AAAA,MAGC,MAAM,IAAI,CAAC,SAAS;AACnB,cAAM,SAAS,KAAK,CAAC;AACrB,cAAM,UAAU,cAAc,MAAM;AACpC,cAAM,aAAa,WAAW,QAAQ,iBAAiB;AAEvD,eACE;AAAA,UAAC;AAAA;AAAA,YAEC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,WAAW;AAAA,oBACP,aAAa,2DAA2D,EAAE;AAAA,YAC9E,SAAS,MAAM,gBAAgB,MAAM;AAAA,YAErC;AAAA,kCAAC,UAAK,WAAW,8CAA8C,aAAa,+BAA+B,uBAAuB,IAC/H,mBACH;AAAA,cACC,KAAK,IAAI,CAAC,SAAS;AAClB,sBAAM,UAAU,KAAK,SAAS,MAAM;AACpC,sBAAM,cAAc,UAAU,MAAM,KAAK;AACzC,uBACE;AAAA,kBAAC;AAAA;AAAA,oBAEC,WAAW;AAAA,0BACP,CAAC,WAAW,CAAC,aAAa,6BAA6B,EAAE;AAAA,0BACzD,eAAe,CAAC,aAAa,2BAA2B,EAAE;AAAA,0BAC1D,eAAe,aAAa,wBAAwB,EAAE;AAAA,oBAEzD,eAAK,QAAQ;AAAA;AAAA,kBANT,KAAK,YAAY;AAAA,gBAOxB;AAAA,cAEJ,CAAC;AAAA;AAAA;AAAA,UAxBI,OAAO,YAAY;AAAA,QAyB1B;AAAA,MAEJ,CAAC;AAAA,OACH;AAAA,KAEJ;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { IconButton } from '@open-mercato/ui/primitives/icon-button'\nimport { useOptionalLocale, useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CalendarDays, ChevronLeft, ChevronRight } from 'lucide-react'\n\ntype CalendarPickerProps = {\n  selectedWeekStart: Date\n  onWeekSelect: (weekStart: Date) => void\n  /**\n   * Reference \"now\". A function is read at click time; a Date is used as rendered.\n   * Defaults to `new Date()`.\n   */\n  today?: Date | (() => Date)\n}\n\nfunction resolveToday(today: CalendarPickerProps['today']): Date {\n  if (typeof today === 'function') return new Date(today())\n  return today ? new Date(today) : new Date()\n}\n\nfunction getMonday(date: Date): Date {\n  const result = new Date(date)\n  const day = result.getDay()\n  const diff = day === 0 ? -6 : 1 - day\n  result.setDate(result.getDate() + diff)\n  result.setHours(0, 0, 0, 0)\n  return result\n}\n\nfunction getWeekNumber(date: Date): number {\n  const target = new Date(Date.UTC(date.getFullYear(), date.getMonth(), date.getDate()))\n  target.setUTCDate(target.getUTCDate() + 4 - (target.getUTCDay() || 7))\n  const yearStart = new Date(Date.UTC(target.getUTCFullYear(), 0, 1))\n  return Math.ceil(((target.getTime() - yearStart.getTime()) / 86400000 + 1) / 7)\n}\n\nfunction isSameDay(first: Date, second: Date): boolean {\n  return first.getFullYear() === second.getFullYear() && first.getMonth() === second.getMonth() && first.getDate() === second.getDate()\n}\n\nfunction isSameWeek(first: Date, second: Date): boolean {\n  return isSameDay(getMonday(first), getMonday(second))\n}\n\nfunction buildWeeks(year: number, month: number): Date[][] {\n  const firstDay = new Date(year, month, 1)\n  const start = getMonday(firstDay)\n  const weeks: Date[][] = []\n  const current = new Date(start)\n\n  for (let weekIdx = 0; weekIdx < 6; weekIdx++) {\n    const week: Date[] = []\n    for (let dayIdx = 0; dayIdx < 7; dayIdx++) {\n      week.push(new Date(current))\n      current.setDate(current.getDate() + 1)\n    }\n    weeks.push(week)\n    if (current.getMonth() !== month && weekIdx >= 3) break\n  }\n  return weeks\n}\n\nfunction getLocalizedDayHeaders(locale: string | undefined): string[] {\n  const baseMonday = new Date(2024, 0, 1) // Known Monday\n  return Array.from({ length: 7 }, (_, idx) => {\n    const date = new Date(baseMonday)\n    date.setDate(date.getDate() + idx)\n    return date.toLocaleDateString(locale, { weekday: 'narrow' })\n  })\n}\n\nexport function CalendarPicker({ selectedWeekStart, onWeekSelect, today: todayProp }: CalendarPickerProps) {\n  const t = useT()\n  const locale = useOptionalLocale()\n  const [open, setOpen] = React.useState(false)\n  const [viewYear, setViewYear] = React.useState(selectedWeekStart.getFullYear())\n  const [viewMonth, setViewMonth] = React.useState(selectedWeekStart.getMonth())\n  const containerRef = React.useRef<HTMLDivElement>(null)\n\n  const dayHeaders = React.useMemo(() => getLocalizedDayHeaders(locale), [locale])\n\n  React.useEffect(() => {\n    function handleClickOutside(event: MouseEvent) {\n      if (containerRef.current && !containerRef.current.contains(event.target as Node)) {\n        setOpen(false)\n      }\n    }\n    if (open) document.addEventListener('mousedown', handleClickOutside)\n    return () => document.removeEventListener('mousedown', handleClickOutside)\n  }, [open])\n\n  React.useEffect(() => {\n    setViewYear(selectedWeekStart.getFullYear())\n    setViewMonth(selectedWeekStart.getMonth())\n  }, [selectedWeekStart])\n\n  const weeks = React.useMemo(() => buildWeeks(viewYear, viewMonth), [viewYear, viewMonth])\n\n  const monthLabel = React.useMemo(() => {\n    return new Date(viewYear, viewMonth, 1).toLocaleString(locale, { month: 'long', year: 'numeric' })\n  }, [locale, viewYear, viewMonth])\n\n  const today = resolveToday(todayProp)\n\n  const handleWeekClick = React.useCallback((monday: Date) => {\n    onWeekSelect(monday)\n    setOpen(false)\n  }, [onWeekSelect])\n\n  const goToPrevMonth = React.useCallback(() => {\n    setViewMonth((prev) => {\n      if (prev === 0) { setViewYear((yr) => yr - 1); return 11 }\n      return prev - 1\n    })\n  }, [])\n\n  const goToNextMonth = React.useCallback(() => {\n    setViewMonth((prev) => {\n      if (prev === 11) { setViewYear((yr) => yr + 1); return 0 }\n      return prev + 1\n    })\n  }, [])\n\n  return (\n    <div ref={containerRef} className=\"relative inline-block\">\n      <IconButton\n        variant=\"outline\"\n        size=\"sm\"\n        type=\"button\"\n        onClick={() => setOpen((prev) => !prev)}\n        aria-label={t('staff.timesheets.my.calendar.open', 'Open calendar')}\n      >\n        <CalendarDays className=\"size-4\" />\n      </IconButton>\n\n      {open && (\n        <div className=\"absolute left-0 z-20 mt-1 w-[280px] rounded-lg border bg-popover p-3 shadow-lg\">\n          {/* Quick links */}\n          <div className=\"mb-3 flex gap-2 border-b pb-2\">\n            <Button\n              type=\"button\"\n              variant=\"ghost\"\n              size=\"sm\"\n              className=\"h-auto px-2 py-1 text-xs\"\n              onClick={() => handleWeekClick(getMonday(resolveToday(todayProp)))}\n            >\n              {t('staff.timesheets.my.calendar.thisWeek', 'This week')}\n            </Button>\n            <Button\n              type=\"button\"\n              variant=\"ghost\"\n              size=\"sm\"\n              className=\"h-auto px-2 py-1 text-xs\"\n              onClick={() => {\n                const lastWeek = resolveToday(todayProp)\n                lastWeek.setDate(lastWeek.getDate() - 7)\n                handleWeekClick(getMonday(lastWeek))\n              }}\n            >\n              {t('staff.timesheets.my.calendar.lastWeek', 'Last week')}\n            </Button>\n          </div>\n\n          {/* Month navigation */}\n          <div className=\"mb-2 flex items-center justify-between\">\n            <IconButton\n              variant=\"ghost\"\n              size=\"xs\"\n              type=\"button\"\n              onClick={goToPrevMonth}\n              aria-label={t('staff.timesheets.my.calendar.prevMonth', 'Previous month')}\n            >\n              <ChevronLeft className=\"size-3.5\" />\n            </IconButton>\n            <span className=\"text-sm font-medium\">{monthLabel}</span>\n            <IconButton\n              variant=\"ghost\"\n              size=\"xs\"\n              type=\"button\"\n              onClick={goToNextMonth}\n              aria-label={t('staff.timesheets.my.calendar.nextMonth', 'Next month')}\n            >\n              <ChevronRight className=\"size-3.5\" />\n            </IconButton>\n          </div>\n\n          {/* Day headers */}\n          <div className=\"grid grid-cols-[32px_repeat(7,1fr)] gap-0 mb-1\">\n            <div />\n            {dayHeaders.map((day, idx) => (\n              <div key={idx} className=\"text-center text-[11px] font-medium text-muted-foreground py-1\">\n                {day}\n              </div>\n            ))}\n          </div>\n\n          {/* Week rows */}\n          {weeks.map((week) => {\n            const monday = week[0]\n            const weekNum = getWeekNumber(monday)\n            const isSelected = isSameWeek(monday, selectedWeekStart)\n\n            return (\n              <Button\n                key={monday.toISOString()}\n                type=\"button\"\n                variant=\"ghost\"\n                className={`grid grid-cols-[32px_repeat(7,1fr)] gap-0 w-full h-auto rounded-md px-0 py-0 hover:bg-muted\n                  ${isSelected ? 'bg-primary text-primary-foreground hover:bg-primary/90' : ''}`}\n                onClick={() => handleWeekClick(monday)}\n              >\n                <span className={`text-[10px] font-medium py-1.5 text-center ${isSelected ? 'text-primary-foreground/70' : 'text-muted-foreground'}`}>\n                  {weekNum}\n                </span>\n                {week.map((date) => {\n                  const inMonth = date.getMonth() === viewMonth\n                  const isTodayDate = isSameDay(date, today)\n                  return (\n                    <span\n                      key={date.toISOString()}\n                      className={`text-xs py-1.5 text-center\n                        ${!inMonth && !isSelected ? 'text-muted-foreground/40' : ''}\n                        ${isTodayDate && !isSelected ? 'font-bold text-primary' : ''}\n                        ${isTodayDate && isSelected ? 'font-bold underline' : ''}`}\n                    >\n                      {date.getDate()}\n                    </span>\n                  )\n                })}\n              </Button>\n            )\n          })}\n        </div>\n      )}\n    </div>\n  )\n}\n"],
+  "mappings": ";AAuIQ,cAME,YANF;AArIR,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB,YAAY;AACxC,SAAS,cAAc,aAAa,oBAAoB;AAYxD,SAAS,aAAa,OAA2C;AAC/D,MAAI,OAAO,UAAU,WAAY,QAAO,IAAI,KAAK,MAAM,CAAC;AACxD,SAAO,QAAQ,IAAI,KAAK,KAAK,IAAI,oBAAI,KAAK;AAC5C;AAEA,SAAS,UAAU,MAAkB;AACnC,QAAM,SAAS,IAAI,KAAK,IAAI;AAC5B,QAAM,MAAM,OAAO,OAAO;AAC1B,QAAM,OAAO,QAAQ,IAAI,KAAK,IAAI;AAClC,SAAO,QAAQ,OAAO,QAAQ,IAAI,IAAI;AACtC,SAAO,SAAS,GAAG,GAAG,GAAG,CAAC;AAC1B,SAAO;AACT;AAEA,SAAS,cAAc,MAAoB;AACzC,QAAM,SAAS,IAAI,KAAK,KAAK,IAAI,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,CAAC,CAAC;AACrF,SAAO,WAAW,OAAO,WAAW,IAAI,KAAK,OAAO,UAAU,KAAK,EAAE;AACrE,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,OAAO,eAAe,GAAG,GAAG,CAAC,CAAC;AAClE,SAAO,KAAK,OAAO,OAAO,QAAQ,IAAI,UAAU,QAAQ,KAAK,QAAW,KAAK,CAAC;AAChF;AAEA,SAAS,UAAU,OAAa,QAAuB;AACrD,SAAO,MAAM,YAAY,MAAM,OAAO,YAAY,KAAK,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK,MAAM,QAAQ,MAAM,OAAO,QAAQ;AACtI;AAEA,SAAS,WAAW,OAAa,QAAuB;AACtD,SAAO,UAAU,UAAU,KAAK,GAAG,UAAU,MAAM,CAAC;AACtD;AAEA,SAAS,WAAW,MAAc,OAAyB;AACzD,QAAM,WAAW,IAAI,KAAK,MAAM,OAAO,CAAC;AACxC,QAAM,QAAQ,UAAU,QAAQ;AAChC,QAAM,QAAkB,CAAC;AACzB,QAAM,UAAU,IAAI,KAAK,KAAK;AAE9B,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAM,OAAe,CAAC;AACtB,aAAS,SAAS,GAAG,SAAS,GAAG,UAAU;AACzC,WAAK,KAAK,IAAI,KAAK,OAAO,CAAC;AAC3B,cAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACvC;AACA,UAAM,KAAK,IAAI;AACf,QAAI,QAAQ,SAAS,MAAM,SAAS,WAAW,EAAG;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,QAAsC;AACpE,QAAM,aAAa,IAAI,KAAK,MAAM,GAAG,CAAC;AACtC,SAAO,MAAM,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,QAAQ;AAC3C,UAAM,OAAO,IAAI,KAAK,UAAU;AAChC,SAAK,QAAQ,KAAK,QAAQ,IAAI,GAAG;AACjC,WAAO,KAAK,mBAAmB,QAAQ,EAAE,SAAS,SAAS,CAAC;AAAA,EAC9D,CAAC;AACH;AAEO,SAAS,eAAe,EAAE,mBAAmB,cAAc,OAAO,UAAU,GAAwB;AACzG,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,kBAAkB;AACjC,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,kBAAkB,YAAY,CAAC;AAC9E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,kBAAkB,SAAS,CAAC;AAC7E,QAAM,eAAe,MAAM,OAAuB,IAAI;AAEtD,QAAM,aAAa,MAAM,QAAQ,MAAM,uBAAuB,MAAM,GAAG,CAAC,MAAM,CAAC;AAE/E,QAAM,UAAU,MAAM;AACpB,aAAS,mBAAmB,OAAmB;AAC7C,UAAI,aAAa,WAAW,CAAC,aAAa,QAAQ,SAAS,MAAM,MAAc,GAAG;AAChF,gBAAQ,KAAK;AAAA,MACf;AAAA,IACF;AACA,QAAI,KAAM,UAAS,iBAAiB,aAAa,kBAAkB;AACnE,WAAO,MAAM,SAAS,oBAAoB,aAAa,kBAAkB;AAAA,EAC3E,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,UAAU,MAAM;AACpB,gBAAY,kBAAkB,YAAY,CAAC;AAC3C,iBAAa,kBAAkB,SAAS,CAAC;AAAA,EAC3C,GAAG,CAAC,iBAAiB,CAAC;AAEtB,QAAM,QAAQ,MAAM,QAAQ,MAAM,WAAW,UAAU,SAAS,GAAG,CAAC,UAAU,SAAS,CAAC;AAExF,QAAM,aAAa,MAAM,QAAQ,MAAM;AACrC,WAAO,IAAI,KAAK,UAAU,WAAW,CAAC,EAAE,eAAe,QAAQ,EAAE,OAAO,QAAQ,MAAM,UAAU,CAAC;AAAA,EACnG,GAAG,CAAC,QAAQ,UAAU,SAAS,CAAC;AAEhC,QAAM,QAAQ,aAAa,SAAS;AAEpC,QAAM,kBAAkB,MAAM,YAAY,CAAC,WAAiB;AAC1D,iBAAa,MAAM;AACnB,YAAQ,KAAK;AAAA,EACf,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,iBAAa,CAAC,SAAS;AACrB,UAAI,SAAS,GAAG;AAAE,oBAAY,CAAC,OAAO,KAAK,CAAC;AAAG,eAAO;AAAA,MAAG;AACzD,aAAO,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,YAAY,MAAM;AAC5C,iBAAa,CAAC,SAAS;AACrB,UAAI,SAAS,IAAI;AAAE,oBAAY,CAAC,OAAO,KAAK,CAAC;AAAG,eAAO;AAAA,MAAE;AACzD,aAAO,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,SACE,qBAAC,SAAI,KAAK,cAAc,WAAU,yBAChC;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS,MAAM,QAAQ,CAAC,SAAS,CAAC,IAAI;AAAA,QACtC,cAAY,EAAE,qCAAqC,eAAe;AAAA,QAElE,8BAAC,gBAAa,WAAU,UAAS;AAAA;AAAA,IACnC;AAAA,IAEC,QACC,qBAAC,SAAI,WAAU,kFAEb;AAAA,2BAAC,SAAI,WAAU,iCACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM,gBAAgB,UAAU,aAAa,SAAS,CAAC,CAAC;AAAA,YAEhE,YAAE,yCAAyC,WAAW;AAAA;AAAA,QACzD;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS,MAAM;AACb,oBAAM,WAAW,aAAa,SAAS;AACvC,uBAAS,QAAQ,SAAS,QAAQ,IAAI,CAAC;AACvC,8BAAgB,UAAU,QAAQ,CAAC;AAAA,YACrC;AAAA,YAEC,YAAE,yCAAyC,WAAW;AAAA;AAAA,QACzD;AAAA,SACF;AAAA,MAGA,qBAAC,SAAI,WAAU,0CACb;AAAA;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,MAAK;AAAA,YACL,SAAS;AAAA,YACT,cAAY,EAAE,0CAA0C,gBAAgB;AAAA,YAExE,8BAAC,eAAY,WAAU,YAAW;AAAA;AAAA,QACpC;AAAA,QACA,oBAAC,UAAK,WAAU,uBAAuB,sBAAW;AAAA,QAClD;AAAA,UAAC;AAAA;AAAA,YACC,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,MAAK;AAAA,YACL,SAAS;AAAA,YACT,cAAY,EAAE,0CAA0C,YAAY;AAAA,YAEpE,8BAAC,gBAAa,WAAU,YAAW;AAAA;AAAA,QACrC;AAAA,SACF;AAAA,MAGA,qBAAC,SAAI,WAAU,kDACb;AAAA,4BAAC,SAAI;AAAA,QACJ,WAAW,IAAI,CAAC,KAAK,QACpB,oBAAC,SAAc,WAAU,kEACtB,iBADO,GAEV,CACD;AAAA,SACH;AAAA,MAGC,MAAM,IAAI,CAAC,SAAS;AACnB,cAAM,SAAS,KAAK,CAAC;AACrB,cAAM,UAAU,cAAc,MAAM;AACpC,cAAM,aAAa,WAAW,QAAQ,iBAAiB;AAEvD,eACE;AAAA,UAAC;AAAA;AAAA,YAEC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,WAAW;AAAA,oBACP,aAAa,2DAA2D,EAAE;AAAA,YAC9E,SAAS,MAAM,gBAAgB,MAAM;AAAA,YAErC;AAAA,kCAAC,UAAK,WAAW,8CAA8C,aAAa,+BAA+B,uBAAuB,IAC/H,mBACH;AAAA,cACC,KAAK,IAAI,CAAC,SAAS;AAClB,sBAAM,UAAU,KAAK,SAAS,MAAM;AACpC,sBAAM,cAAc,UAAU,MAAM,KAAK;AACzC,uBACE;AAAA,kBAAC;AAAA;AAAA,oBAEC,WAAW;AAAA,0BACP,CAAC,WAAW,CAAC,aAAa,6BAA6B,EAAE;AAAA,0BACzD,eAAe,CAAC,aAAa,2BAA2B,EAAE;AAAA,0BAC1D,eAAe,aAAa,wBAAwB,EAAE;AAAA,oBAEzD,eAAK,QAAQ;AAAA;AAAA,kBANT,KAAK,YAAY;AAAA,gBAOxB;AAAA,cAEJ,CAAC;AAAA;AAAA;AAAA,UAxBI,OAAO,YAAY;AAAA,QAyB1B;AAAA,MAEJ,CAAC;AAAA,OACH;AAAA,KAEJ;AAEJ;",
   "names": []
 }

package/dist/modules/sync_excel/api/import/route.js

@@ -3,6 +3,7 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { z } from "zod";
 import { startDataSyncRun } from "@open-mercato/core/modules/data_sync/lib/start-run";
 import { SyncMapping } from "@open-mercato/core/modules/data_sync/data/entities";
@@ -33,7 +34,7 @@ const openApi = {
         { status: 401, description: "Unauthorized", schema: errorSchema },
         { status: 404, description: "Upload not found", schema: errorSchema },
         { status: 409, description: "Import overlap detected", schema: errorSchema },
-        { status: 422, description: "Invalid import payload", schema: errorSchema }
+        { status: 422, description: "Invalid import payload or import blocked by a mutation guard", schema: errorSchema }
       ]
     }
   }
@@ -88,13 +89,30 @@ async function POST(request) {
     if (!attachment) {
       return NextResponse.json({ error: "Upload attachment not found." }, { status: 404 });
     }
-    if (upload.entityType !== parsedPayload.data.entityType) {
+    const guarded = await runRouteMutationGuards({
+      container,
+      req: request,
+      auth: { userId: auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId },
+      input: {
+        resourceKind: "sync_excel.upload",
+        resourceId: upload.id,
+        operation: "update",
+        mutationPayload: { ...parsedPayload.data }
+      }
+    });
+    if (!guarded.ok) return guarded.response;
+    const guardedPayload = guarded.modifiedPayload ? syncExcelImportRequestSchema.safeParse({ ...parsedPayload.data, ...guarded.modifiedPayload }) : parsedPayload;
+    if (!guardedPayload.success) {
+      return NextResponse.json({ error: "Invalid import payload." }, { status: 422 });
+    }
+    const input = guardedPayload.data;
+    if (upload.entityType !== input.entityType) {
       return NextResponse.json({ error: "Upload entity type does not match requested import target." }, { status: 422 });
     }
-    if (parsedPayload.data.mapping.entityType !== parsedPayload.data.entityType) {
+    if (input.mapping.entityType !== input.entityType) {
       return NextResponse.json({ error: "Mapping entity type does not match requested import target." }, { status: 422 });
     }
-    const overlap = await syncRunService.findRunningOverlap("sync_excel", parsedPayload.data.entityType, "import", scope);
+    const overlap = await syncRunService.findRunningOverlap("sync_excel", input.entityType, "import", scope);
     if (overlap) {
       return NextResponse.json({ error: "A sync_excel import is already in progress for this entity type." }, { status: 409 });
     }
@@ -103,28 +121,32 @@ async function POST(request) {
       SyncMapping,
       {
         integrationId: "sync_excel",
-        entityType: parsedPayload.data.entityType,
+        entityType: input.entityType,
         organizationId: scope.organizationId,
         tenantId: scope.tenantId
       },
       void 0,
       scope
     );
+    const afterCommitCallbacks = [];
     await em.transactional(async () => {
       if (existingMapping) {
-        existingMapping.mapping = parsedPayload.data.mapping;
+        existingMapping.mapping = input.mapping;
       } else {
         em.persist(em.create(SyncMapping, {
           integrationId: "sync_excel",
-          entityType: parsedPayload.data.entityType,
-          mapping: parsedPayload.data.mapping,
+          entityType: input.entityType,
+          mapping: input.mapping,
           organizationId: scope.organizationId,
           tenantId: scope.tenantId
         }));
       }
-      await credentialsService.save("sync_excel", {}, scope);
+      await credentialsService.save("sync_excel", {}, scope, {
+        deferAfterCommit: (callback) => afterCommitCallbacks.push(callback)
+      });
       await integrationStateService.upsert("sync_excel", { isEnabled: true }, scope);
     });
+    for (const callback of afterCommitCallbacks) await callback();
     const { run, progressJob } = await startDataSyncRun({
       syncRunService,
       progressService,
@@ -134,14 +156,14 @@ async function POST(request) {
       },
       input: {
         integrationId: "sync_excel",
-        entityType: parsedPayload.data.entityType,
+        entityType: input.entityType,
         direction: "import",
         cursor: createCursor(upload.id, 0),
         triggeredBy: auth.sub,
-        batchSize: parsedPayload.data.batchSize ?? 100,
+        batchSize: input.batchSize ?? 100,
         progressJob: {
           jobType: "sync_excel:import",
-          name: `CSV import \u2014 ${parsedPayload.data.entityType}`,
+          name: `CSV import \u2014 ${input.entityType}`,
           description: upload.filename,
           meta: {
             integrationId: "sync_excel",
@@ -155,6 +177,7 @@ async function POST(request) {
       upload.syncRunId = run.id;
       upload.status = "importing";
     });
+    await guarded.runAfterSuccess();
     return NextResponse.json(syncExcelImportResponseSchema.parse({
       runId: run.id,
       progressJobId: progressJob?.id ?? null,

package/dist/modules/sync_excel/api/import/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sync_excel/api/import/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { z } from 'zod'\nimport type { ProgressService } from '@open-mercato/core/modules/progress/lib/progressService'\nimport type { SyncRunService } from '@open-mercato/core/modules/data_sync/lib/sync-run-service'\nimport { startDataSyncRun } from '@open-mercato/core/modules/data_sync/lib/start-run'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '@open-mercato/core/modules/integrations/lib/state-service'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { Attachment } from '../../../attachments/data/entities'\nimport { createCursor } from '../../lib/adapters/customers'\nimport {\n  syncExcelImportRequestSchema,\n  syncExcelImportResponseSchema,\n} from '../../data/validators'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sync_excel').child({ component: 'import' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Start a CSV import run for a stored sync_excel upload',\n  methods: {\n    POST: {\n      summary: 'Start CSV import',\n      responses: [\n        { status: 201, description: 'Import run started', schema: syncExcelImportResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Upload not found', schema: errorSchema },\n        { status: 409, description: 'Import overlap detected', schema: errorSchema },\n        { status: 422, description: 'Invalid import payload', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  try {\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const payload = await readJsonSafe(request)\n    const parsedPayload = syncExcelImportRequestSchema.safeParse(payload)\n    if (!parsedPayload.success) {\n      return NextResponse.json({ error: 'Invalid import payload.' }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n    const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n    if (!scopeResult.ok) {\n      return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n    }\n    const { scope } = scopeResult\n\n    const upload = await findOneWithDecryption(\n      em,\n      SyncExcelUpload,\n      {\n        id: parsedPayload.data.uploadId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!upload) {\n      return NextResponse.json({ error: 'Upload preview not found.' }, { status: 404 })\n    }\n\n    const attachment = await findOneWithDecryption(\n      em,\n      Attachment,\n      {\n        id: upload.attachmentId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!attachment) {\n      return NextResponse.json({ error: 'Upload attachment not found.' }, { status: 404 })\n    }\n\n    if (upload.entityType !== parsedPayload.data.entityType) {\n      return NextResponse.json({ error: 'Upload entity type does not match requested import target.' }, { status: 422 })\n    }\n\n    if (parsedPayload.data.mapping.entityType !== parsedPayload.data.entityType) {\n      return NextResponse.json({ error: 'Mapping entity type does not match requested import target.' }, { status: 422 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap('sync_excel', parsedPayload.data.entityType, 'import', scope)\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync_excel import is already in progress for this entity type.' }, { status: 409 })\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      SyncMapping,\n      {\n        integrationId: 'sync_excel',\n        entityType: parsedPayload.data.entityType,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    // Persist the mapping, credentials, and integration-state config atomically.\n    // credentialsService / integrationStateService are request-scoped and share\n    // this request `em`, so a single transaction covers all of their writes.\n    await em.transactional(async () => {\n      if (existingMapping) {\n        existingMapping.mapping = parsedPayload.data.mapping\n      } else {\n        em.persist(em.create(SyncMapping, {\n          integrationId: 'sync_excel',\n          entityType: parsedPayload.data.entityType,\n          mapping: parsedPayload.data.mapping,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n        }))\n      }\n\n      await credentialsService.save('sync_excel', {}, scope)\n      await integrationStateService.upsert('sync_excel', { isEnabled: true }, scope)\n    })\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: 'sync_excel',\n        entityType: parsedPayload.data.entityType,\n        direction: 'import',\n        cursor: createCursor(upload.id, 0),\n        triggeredBy: auth.sub,\n        batchSize: parsedPayload.data.batchSize ?? 100,\n        progressJob: {\n          jobType: 'sync_excel:import',\n          name: `CSV import \u2014 ${parsedPayload.data.entityType}`,\n          description: upload.filename,\n          meta: {\n            integrationId: 'sync_excel',\n            uploadId: upload.id,\n            hiddenFromTopBar: false,\n          },\n        },\n      },\n    })\n\n    await em.transactional(async () => {\n      upload.syncRunId = run.id\n      upload.status = 'importing'\n    })\n\n    return NextResponse.json(syncExcelImportResponseSchema.parse({\n      runId: run.id,\n      progressJobId: progressJob?.id ?? null,\n      status: run.status,\n    }), { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting import', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start sync_excel import.' },\n      { status: 500 },\n    )\n  }\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAGlB,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAG5B,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,8BAA8B;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,UAAU,MAAM,aAAa,OAAO;AAC1C,UAAM,gBAAgB,6BAA6B,UAAU,OAAO;AACpE,QAAI,CAAC,cAAc,SAAS;AAC1B,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,UAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IACvF;AACA,UAAM,EAAE,MAAM,IAAI;AAElB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,cAAc,KAAK;AAAA,QACvB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,OAAO;AAAA,QACX,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,QAAI,OAAO,eAAe,cAAc,KAAK,YAAY;AACvD,aAAO,aAAa,KAAK,EAAE,OAAO,6DAA6D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnH;AAEA,QAAI,cAAc,KAAK,QAAQ,eAAe,cAAc,KAAK,YAAY;AAC3E,aAAO,aAAa,KAAK,EAAE,OAAO,8DAA8D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH;AAEA,UAAM,UAAU,MAAM,eAAe,mBAAmB,cAAc,cAAc,KAAK,YAAY,UAAU,KAAK;AACpH,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,mEAAmE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzH;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,YAAY,cAAc,KAAK;AAAA,QAC/B,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAKA,UAAM,GAAG,cAAc,YAAY;AACjC,UAAI,iBAAiB;AACnB,wBAAgB,UAAU,cAAc,KAAK;AAAA,MAC/C,OAAO;AACL,WAAG,QAAQ,GAAG,OAAO,aAAa;AAAA,UAChC,eAAe;AAAA,UACf,YAAY,cAAc,KAAK;AAAA,UAC/B,SAAS,cAAc,KAAK;AAAA,UAC5B,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,QAClB,CAAC,CAAC;AAAA,MACJ;AAEA,YAAM,mBAAmB,KAAK,cAAc,CAAC,GAAG,KAAK;AACrD,YAAM,wBAAwB,OAAO,cAAc,EAAE,WAAW,KAAK,GAAG,KAAK;AAAA,IAC/E,CAAC;AAED,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe;AAAA,QACf,YAAY,cAAc,KAAK;AAAA,QAC/B,WAAW;AAAA,QACX,QAAQ,aAAa,OAAO,IAAI,CAAC;AAAA,QACjC,aAAa,KAAK;AAAA,QAClB,WAAW,cAAc,KAAK,aAAa;AAAA,QAC3C,aAAa;AAAA,UACX,SAAS;AAAA,UACT,MAAM,qBAAgB,cAAc,KAAK,UAAU;AAAA,UACnD,aAAa,OAAO;AAAA,UACpB,MAAM;AAAA,YACJ,eAAe;AAAA,YACf,UAAU,OAAO;AAAA,YACjB,kBAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,YAAY;AACjC,aAAO,YAAY,IAAI;AACvB,aAAO,SAAS;AAAA,IAClB,CAAC;AAED,WAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,MAC3D,OAAO,IAAI;AAAA,MACX,eAAe,aAAa,MAAM;AAAA,MAClC,QAAQ,IAAI;AAAA,IACd,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,mCAAmC,EAAE,SAAS,MAAM,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qCAAqC;AAAA,MAC9C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { z } from 'zod'\nimport type { ProgressService } from '@open-mercato/core/modules/progress/lib/progressService'\nimport type { SyncRunService } from '@open-mercato/core/modules/data_sync/lib/sync-run-service'\nimport { startDataSyncRun } from '@open-mercato/core/modules/data_sync/lib/start-run'\nimport { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'\nimport type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '@open-mercato/core/modules/integrations/lib/state-service'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { Attachment } from '../../../attachments/data/entities'\nimport { createCursor } from '../../lib/adapters/customers'\nimport {\n  syncExcelImportRequestSchema,\n  syncExcelImportResponseSchema,\n} from '../../data/validators'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('sync_excel').child({ component: 'import' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Start a CSV import run for a stored sync_excel upload',\n  methods: {\n    POST: {\n      summary: 'Start CSV import',\n      responses: [\n        { status: 201, description: 'Import run started', schema: syncExcelImportResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Upload not found', schema: errorSchema },\n        { status: 409, description: 'Import overlap detected', schema: errorSchema },\n        { status: 422, description: 'Invalid import payload or import blocked by a mutation guard', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  try {\n    const auth = await getAuthFromRequest(request)\n    if (!auth?.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const payload = await readJsonSafe(request)\n    const parsedPayload = syncExcelImportRequestSchema.safeParse(payload)\n    if (!parsedPayload.success) {\n      return NextResponse.json({ error: 'Invalid import payload.' }, { status: 422 })\n    }\n\n    const container = await createRequestContainer()\n    const em = container.resolve('em') as EntityManager\n    const syncRunService = container.resolve('dataSyncRunService') as SyncRunService\n    const progressService = container.resolve('progressService') as ProgressService\n    const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n    const integrationStateService = container.resolve('integrationStateService') as IntegrationStateService\n    const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n    if (!scopeResult.ok) {\n      return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n    }\n    const { scope } = scopeResult\n\n    const upload = await findOneWithDecryption(\n      em,\n      SyncExcelUpload,\n      {\n        id: parsedPayload.data.uploadId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!upload) {\n      return NextResponse.json({ error: 'Upload preview not found.' }, { status: 404 })\n    }\n\n    const attachment = await findOneWithDecryption(\n      em,\n      Attachment,\n      {\n        id: upload.attachmentId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!attachment) {\n      return NextResponse.json({ error: 'Upload attachment not found.' }, { status: 404 })\n    }\n\n    const guarded = await runRouteMutationGuards({\n      container,\n      req: request,\n      auth: { userId: auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId },\n      input: {\n        resourceKind: 'sync_excel.upload',\n        resourceId: upload.id,\n        operation: 'update',\n        mutationPayload: { ...parsedPayload.data },\n      },\n    })\n    if (!guarded.ok) return guarded.response\n\n    const guardedPayload = guarded.modifiedPayload\n      ? syncExcelImportRequestSchema.safeParse({ ...parsedPayload.data, ...guarded.modifiedPayload })\n      : parsedPayload\n    if (!guardedPayload.success) {\n      return NextResponse.json({ error: 'Invalid import payload.' }, { status: 422 })\n    }\n    const input = guardedPayload.data\n\n    if (upload.entityType !== input.entityType) {\n      return NextResponse.json({ error: 'Upload entity type does not match requested import target.' }, { status: 422 })\n    }\n\n    if (input.mapping.entityType !== input.entityType) {\n      return NextResponse.json({ error: 'Mapping entity type does not match requested import target.' }, { status: 422 })\n    }\n\n    const overlap = await syncRunService.findRunningOverlap('sync_excel', input.entityType, 'import', scope)\n    if (overlap) {\n      return NextResponse.json({ error: 'A sync_excel import is already in progress for this entity type.' }, { status: 409 })\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      SyncMapping,\n      {\n        integrationId: 'sync_excel',\n        entityType: input.entityType,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    // Persist the mapping, credentials, and integration-state config atomically.\n    // credentialsService / integrationStateService are request-scoped and share\n    // this request `em`, so a single transaction covers all of their writes.\n    const afterCommitCallbacks: Array<() => void | Promise<void>> = []\n    await em.transactional(async () => {\n      if (existingMapping) {\n        existingMapping.mapping = input.mapping\n      } else {\n        em.persist(em.create(SyncMapping, {\n          integrationId: 'sync_excel',\n          entityType: input.entityType,\n          mapping: input.mapping,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n        }))\n      }\n\n      await credentialsService.save('sync_excel', {}, scope, {\n        deferAfterCommit: (callback) => afterCommitCallbacks.push(callback),\n      })\n      await integrationStateService.upsert('sync_excel', { isEnabled: true }, scope)\n    })\n    for (const callback of afterCommitCallbacks) await callback()\n\n    const { run, progressJob } = await startDataSyncRun({\n      syncRunService,\n      progressService,\n      scope: {\n        ...scope,\n        userId: auth.sub,\n      },\n      input: {\n        integrationId: 'sync_excel',\n        entityType: input.entityType,\n        direction: 'import',\n        cursor: createCursor(upload.id, 0),\n        triggeredBy: auth.sub,\n        batchSize: input.batchSize ?? 100,\n        progressJob: {\n          jobType: 'sync_excel:import',\n          name: `CSV import \u2014 ${input.entityType}`,\n          description: upload.filename,\n          meta: {\n            integrationId: 'sync_excel',\n            uploadId: upload.id,\n            hiddenFromTopBar: false,\n          },\n        },\n      },\n    })\n\n    await em.transactional(async () => {\n      upload.syncRunId = run.id\n      upload.status = 'importing'\n    })\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json(syncExcelImportResponseSchema.parse({\n      runId: run.id,\n      progressJobId: progressJob?.id ?? null,\n      status: run.status,\n    }), { status: 201 })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    const stack = error instanceof Error ? error.stack : undefined\n    logger.error('Unhandled error starting import', { message, stack })\n    return NextResponse.json(\n      { error: 'Failed to start sync_excel import.' },\n      { status: 500 },\n    )\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC,SAAS,8BAA8B;AACvC,SAAS,SAAS;AAGlB,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAG5B,SAAS,uBAAuB;AAChC,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,8BAA8B;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gEAAgE,QAAQ,YAAY;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,QAAI,CAAC,MAAM,UAAU;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,UAAU,MAAM,aAAa,OAAO;AAC1C,UAAM,gBAAgB,6BAA6B,UAAU,OAAO;AACpE,QAAI,CAAC,cAAc,SAAS;AAC1B,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,UAAM,iBAAiB,UAAU,QAAQ,oBAAoB;AAC7D,UAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,UAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,UAAM,0BAA0B,UAAU,QAAQ,yBAAyB;AAC3E,UAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IACvF;AACA,UAAM,EAAE,MAAM,IAAI;AAElB,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,cAAc,KAAK;AAAA,QACvB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,OAAO;AAAA,QACX,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrF;AAEA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C;AAAA,MACA,KAAK;AAAA,MACL,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACzF,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,iBAAiB,EAAE,GAAG,cAAc,KAAK;AAAA,MAC3C;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,UAAM,iBAAiB,QAAQ,kBAC3B,6BAA6B,UAAU,EAAE,GAAG,cAAc,MAAM,GAAG,QAAQ,gBAAgB,CAAC,IAC5F;AACJ,QAAI,CAAC,eAAe,SAAS;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChF;AACA,UAAM,QAAQ,eAAe;AAE7B,QAAI,OAAO,eAAe,MAAM,YAAY;AAC1C,aAAO,aAAa,KAAK,EAAE,OAAO,6DAA6D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnH;AAEA,QAAI,MAAM,QAAQ,eAAe,MAAM,YAAY;AACjD,aAAO,aAAa,KAAK,EAAE,OAAO,8DAA8D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpH;AAEA,UAAM,UAAU,MAAM,eAAe,mBAAmB,cAAc,MAAM,YAAY,UAAU,KAAK;AACvG,QAAI,SAAS;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,mEAAmE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzH;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAKA,UAAM,uBAA0D,CAAC;AACjE,UAAM,GAAG,cAAc,YAAY;AACjC,UAAI,iBAAiB;AACnB,wBAAgB,UAAU,MAAM;AAAA,MAClC,OAAO;AACL,WAAG,QAAQ,GAAG,OAAO,aAAa;AAAA,UAChC,eAAe;AAAA,UACf,YAAY,MAAM;AAAA,UAClB,SAAS,MAAM;AAAA,UACf,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,QAClB,CAAC,CAAC;AAAA,MACJ;AAEA,YAAM,mBAAmB,KAAK,cAAc,CAAC,GAAG,OAAO;AAAA,QACrD,kBAAkB,CAAC,aAAa,qBAAqB,KAAK,QAAQ;AAAA,MACpE,CAAC;AACD,YAAM,wBAAwB,OAAO,cAAc,EAAE,WAAW,KAAK,GAAG,KAAK;AAAA,IAC/E,CAAC;AACD,eAAW,YAAY,qBAAsB,OAAM,SAAS;AAE5D,UAAM,EAAE,KAAK,YAAY,IAAI,MAAM,iBAAiB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,OAAO;AAAA,QACL,GAAG;AAAA,QACH,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,OAAO;AAAA,QACL,eAAe;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,QAAQ,aAAa,OAAO,IAAI,CAAC;AAAA,QACjC,aAAa,KAAK;AAAA,QAClB,WAAW,MAAM,aAAa;AAAA,QAC9B,aAAa;AAAA,UACX,SAAS;AAAA,UACT,MAAM,qBAAgB,MAAM,UAAU;AAAA,UACtC,aAAa,OAAO;AAAA,UACpB,MAAM;AAAA,YACJ,eAAe;AAAA,YACf,UAAU,OAAO;AAAA,YACjB,kBAAkB;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,GAAG,cAAc,YAAY;AACjC,aAAO,YAAY,IAAI;AACvB,aAAO,SAAS;AAAA,IAClB,CAAC;AAED,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,MAC3D,OAAO,IAAI;AAAA,MACX,eAAe,aAAa,MAAM;AAAA,MAClC,QAAQ,IAAI;AAAA,IACd,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrB,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAM,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ;AACrD,WAAO,MAAM,mCAAmC,EAAE,SAAS,MAAM,CAAC;AAClE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qCAAqC;AAAA,MAC9C,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/sync_excel/api/upload/route.js

@@ -2,6 +2,7 @@ import { randomUUID } from "crypto";
 import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
 import { z } from "zod";
 import { syncExcelUploadResponseSchema, syncExcelEntityTypeSchema } from "../../data/validators.js";
 import { SyncExcelUpload } from "../../data/entities.js";
@@ -40,7 +41,7 @@ const openApi = {
         { status: 400, description: "Invalid multipart payload", schema: errorSchema },
         { status: 401, description: "Unauthorized", schema: errorSchema },
         { status: 413, description: "CSV upload exceeds the maximum upload size", schema: errorSchema },
-        { status: 422, description: "Unsupported entity type or file type", schema: errorSchema }
+        { status: 422, description: "Unsupported entity type, file type, or upload blocked by a mutation guard", schema: errorSchema }
       ]
     }
   }
@@ -92,11 +93,34 @@ async function POST(request) {
   if (file.size > maxUploadBytes) {
     return NextResponse.json({ error: "CSV upload exceeds the maximum upload size." }, { status: 413 });
   }
+  const uploadId = randomUUID();
+  const mutationPayload = {
+    entityType: parsedPayload.data.entityType,
+    filename: file.name,
+    mimeType: file.type || "text/csv",
+    fileSize: file.size
+  };
+  const guarded = await runRouteMutationGuards({
+    container,
+    req: request,
+    auth: { userId: auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    input: {
+      resourceKind: "sync_excel.upload",
+      resourceId: uploadId,
+      operation: "create",
+      mutationPayload
+    }
+  });
+  if (!guarded.ok) return guarded.response;
+  const guardedPayload = guarded.modifiedPayload ? multipartSchema.safeParse({ ...mutationPayload, ...guarded.modifiedPayload }) : parsedPayload;
+  if (!guardedPayload.success) {
+    return NextResponse.json({ error: "Invalid upload payload." }, { status: 422 });
+  }
+  const entityType = guardedPayload.data.entityType;
   const fileBuffer = Buffer.from(await file.arrayBuffer());
   const preview = parseCsvPreview(fileBuffer, { maxRows: 5 });
-  const suggestedMapping = buildSuggestedMapping(parsedPayload.data.entityType, preview.headers);
+  const suggestedMapping = buildSuggestedMapping(entityType, preview.headers);
   const em = container.resolve("em");
-  const uploadId = randomUUID();
   const attachment = await createSyncExcelUploadAttachment({
     em,
     uploadId,
@@ -112,7 +136,7 @@ async function POST(request) {
     filename: file.name,
     mimeType: file.type || "text/csv",
     fileSize: fileBuffer.length,
-    entityType: parsedPayload.data.entityType,
+    entityType,
     delimiter: preview.delimiter,
     encoding: preview.encoding,
     headers: preview.headers,
@@ -124,6 +148,7 @@ async function POST(request) {
   });
   em.persist(upload);
   await em.flush();
+  await guarded.runAfterSuccess();
   return NextResponse.json(syncExcelUploadResponseSchema.parse({
     uploadId: upload.id,
     filename: upload.filename,

package/dist/modules/sync_excel/api/upload/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/sync_excel/api/upload/route.ts"],
-  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { z } from 'zod'\nimport { syncExcelUploadResponseSchema, syncExcelEntityTypeSchema } from '../../data/validators'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { buildSuggestedMapping } from '../../lib/mapping'\nimport { parseCsvPreview } from '../../lib/parser'\nimport { createSyncExcelUploadAttachment } from '../../lib/upload-storage'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  isMultipartUploadLimitError,\n  parseMultipartFormDataWithinUploadLimit,\n  resolveDefaultAttachmentMaxUploadBytes,\n} from '../../../attachments/lib/upload-limits'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst multipartSchema = z.object({\n  entityType: syncExcelEntityTypeSchema.default('customers.person'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Upload CSV file for sync_excel preview',\n  methods: {\n    POST: {\n      summary: 'Upload CSV file',\n      requestBody: {\n        contentType: 'multipart/form-data',\n      },\n      responses: [\n        { status: 200, description: 'CSV uploaded and preview parsed', schema: syncExcelUploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid multipart payload', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 413, description: 'CSV upload exceeds the maximum upload size', schema: errorSchema },\n        { status: 422, description: 'Unsupported entity type or file type', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n  if (!scopeResult.ok) {\n    return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n  }\n  const { scope } = scopeResult\n\n  const contentType = request.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  let formData: FormData\n  try {\n    formData = await parseMultipartFormDataWithinUploadLimit(request)\n  } catch (error) {\n    if (isMultipartUploadLimitError(error)) {\n      return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n    }\n    throw error\n  }\n  const parsedPayload = multipartSchema.safeParse({\n    entityType: typeof formData.get('entityType') === 'string' ? formData.get('entityType') : undefined,\n  })\n\n  if (!parsedPayload.success) {\n    return NextResponse.json({ error: 'Invalid upload payload.' }, { status: 422 })\n  }\n\n  const file = formData.get('file')\n  if (!(file instanceof File)) {\n    return NextResponse.json({ error: 'Select a CSV file to upload.' }, { status: 400 })\n  }\n\n  const supportedMimeTypes = new Set(['text/csv', 'application/vnd.ms-excel', 'application/csv'])\n  const isCsvByMime = supportedMimeTypes.has(file.type)\n  const isCsvByName = file.name.toLowerCase().endsWith('.csv')\n\n  if (!isCsvByMime && !isCsvByName) {\n    return NextResponse.json({ error: 'Only CSV uploads are supported in this foundation slice.' }, { status: 422 })\n  }\n\n  const maxUploadBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (file.size > maxUploadBytes) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const fileBuffer = Buffer.from(await file.arrayBuffer())\n  const preview = parseCsvPreview(fileBuffer, { maxRows: 5 })\n  const suggestedMapping = buildSuggestedMapping(parsedPayload.data.entityType, preview.headers)\n\n  const em = container.resolve('em') as EntityManager\n  const uploadId = randomUUID()\n  const attachment = await createSyncExcelUploadAttachment({\n    em,\n    uploadId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    fileName: file.name,\n    mimeType: file.type || 'text/csv',\n    buffer: fileBuffer,\n  })\n\n  const upload = em.create(SyncExcelUpload, {\n    id: uploadId,\n    attachmentId: attachment.id,\n    filename: file.name,\n    mimeType: file.type || 'text/csv',\n    fileSize: fileBuffer.length,\n    entityType: parsedPayload.data.entityType,\n    delimiter: preview.delimiter,\n    encoding: preview.encoding,\n    headers: preview.headers,\n    sampleRows: preview.sampleRows,\n    totalRows: preview.totalRows,\n    status: 'uploaded',\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n\n  em.persist(upload)\n  await em.flush()\n\n  return NextResponse.json(syncExcelUploadResponseSchema.parse({\n    uploadId: upload.id,\n    filename: upload.filename,\n    mimeType: upload.mimeType,\n    fileSize: upload.fileSize,\n    entityType: upload.entityType,\n    headers: upload.headers,\n    sampleRows: upload.sampleRows,\n    totalRows: upload.totalRows,\n    suggestedMapping,\n  }))\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,SAAS;AAClB,SAAS,+BAA+B,iCAAiC;AACzE,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,YAAY,0BAA0B,QAAQ,kBAAkB;AAClE,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,8BAA8B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AACA,QAAM,EAAE,MAAM,IAAI;AAElB,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wCAAwC,OAAO;AAAA,EAClE,SAAS,OAAO;AACd,QAAI,4BAA4B,KAAK,GAAG;AACtC,aAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,UAAM;AAAA,EACR;AACA,QAAM,gBAAgB,gBAAgB,UAAU;AAAA,IAC9C,YAAY,OAAO,SAAS,IAAI,YAAY,MAAM,WAAW,SAAS,IAAI,YAAY,IAAI;AAAA,EAC5F,CAAC;AAED,MAAI,CAAC,cAAc,SAAS;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,EAAE,gBAAgB,OAAO;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,qBAAqB,oBAAI,IAAI,CAAC,YAAY,4BAA4B,iBAAiB,CAAC;AAC9F,QAAM,cAAc,mBAAmB,IAAI,KAAK,IAAI;AACpD,QAAM,cAAc,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM;AAE3D,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,2DAA2D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjH;AAEA,QAAM,iBAAiB,uCAAuC;AAC9D,MAAI,KAAK,OAAO,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,aAAa,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACvD,QAAM,UAAU,gBAAgB,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1D,QAAM,mBAAmB,sBAAsB,cAAc,KAAK,YAAY,QAAQ,OAAO;AAE7F,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,WAAW;AAC5B,QAAM,aAAa,MAAM,gCAAgC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,IACxC,IAAI;AAAA,IACJ,cAAc,WAAW;AAAA,IACzB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,YAAY,cAAc,KAAK;AAAA,IAC/B,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,QAAQ;AAAA,IACR,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AAED,KAAG,QAAQ,MAAM;AACjB,QAAM,GAAG,MAAM;AAEf,SAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB;AAAA,EACF,CAAC,CAAC;AACJ;",
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { z } from 'zod'\nimport { syncExcelUploadResponseSchema, syncExcelEntityTypeSchema } from '../../data/validators'\nimport { SyncExcelUpload } from '../../data/entities'\nimport { buildSuggestedMapping } from '../../lib/mapping'\nimport { parseCsvPreview } from '../../lib/parser'\nimport { createSyncExcelUploadAttachment } from '../../lib/upload-storage'\nimport { resolveSyncExcelConcreteScope } from '../../lib/scope'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  isMultipartUploadLimitError,\n  parseMultipartFormDataWithinUploadLimit,\n  resolveDefaultAttachmentMaxUploadBytes,\n} from '../../../attachments/lib/upload-limits'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['sync_excel.run'] },\n}\n\nconst multipartSchema = z.object({\n  entityType: syncExcelEntityTypeSchema.default('customers.person'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi = {\n  tags: ['SyncExcel'],\n  summary: 'Upload CSV file for sync_excel preview',\n  methods: {\n    POST: {\n      summary: 'Upload CSV file',\n      requestBody: {\n        contentType: 'multipart/form-data',\n      },\n      responses: [\n        { status: 200, description: 'CSV uploaded and preview parsed', schema: syncExcelUploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid multipart payload', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 413, description: 'CSV upload exceeds the maximum upload size', schema: errorSchema },\n        { status: 422, description: 'Unsupported entity type, file type, or upload blocked by a mutation guard', schema: errorSchema },\n      ],\n    },\n  },\n}\n\nexport async function POST(request: Request) {\n  const auth = await getAuthFromRequest(request)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const scopeResult = await resolveSyncExcelConcreteScope({ auth, container, request })\n  if (!scopeResult.ok) {\n    return NextResponse.json({ error: scopeResult.error }, { status: scopeResult.status })\n  }\n  const { scope } = scopeResult\n\n  const contentType = request.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(request.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  let formData: FormData\n  try {\n    formData = await parseMultipartFormDataWithinUploadLimit(request)\n  } catch (error) {\n    if (isMultipartUploadLimitError(error)) {\n      return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n    }\n    throw error\n  }\n  const parsedPayload = multipartSchema.safeParse({\n    entityType: typeof formData.get('entityType') === 'string' ? formData.get('entityType') : undefined,\n  })\n\n  if (!parsedPayload.success) {\n    return NextResponse.json({ error: 'Invalid upload payload.' }, { status: 422 })\n  }\n\n  const file = formData.get('file')\n  if (!(file instanceof File)) {\n    return NextResponse.json({ error: 'Select a CSV file to upload.' }, { status: 400 })\n  }\n\n  const supportedMimeTypes = new Set(['text/csv', 'application/vnd.ms-excel', 'application/csv'])\n  const isCsvByMime = supportedMimeTypes.has(file.type)\n  const isCsvByName = file.name.toLowerCase().endsWith('.csv')\n\n  if (!isCsvByMime && !isCsvByName) {\n    return NextResponse.json({ error: 'Only CSV uploads are supported in this foundation slice.' }, { status: 422 })\n  }\n\n  const maxUploadBytes = resolveDefaultAttachmentMaxUploadBytes()\n  if (file.size > maxUploadBytes) {\n    return NextResponse.json({ error: 'CSV upload exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const uploadId = randomUUID()\n  const mutationPayload: Record<string, unknown> = {\n    entityType: parsedPayload.data.entityType,\n    filename: file.name,\n    mimeType: file.type || 'text/csv',\n    fileSize: file.size,\n  }\n  const guarded = await runRouteMutationGuards({\n    container,\n    req: request,\n    auth: { userId: auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId },\n    input: {\n      resourceKind: 'sync_excel.upload',\n      resourceId: uploadId,\n      operation: 'create',\n      mutationPayload,\n    },\n  })\n  if (!guarded.ok) return guarded.response\n\n  const guardedPayload = guarded.modifiedPayload\n    ? multipartSchema.safeParse({ ...mutationPayload, ...guarded.modifiedPayload })\n    : parsedPayload\n  if (!guardedPayload.success) {\n    return NextResponse.json({ error: 'Invalid upload payload.' }, { status: 422 })\n  }\n  const entityType = guardedPayload.data.entityType\n\n  const fileBuffer = Buffer.from(await file.arrayBuffer())\n  const preview = parseCsvPreview(fileBuffer, { maxRows: 5 })\n  const suggestedMapping = buildSuggestedMapping(entityType, preview.headers)\n\n  const em = container.resolve('em') as EntityManager\n  const attachment = await createSyncExcelUploadAttachment({\n    em,\n    uploadId,\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    fileName: file.name,\n    mimeType: file.type || 'text/csv',\n    buffer: fileBuffer,\n  })\n\n  const upload = em.create(SyncExcelUpload, {\n    id: uploadId,\n    attachmentId: attachment.id,\n    filename: file.name,\n    mimeType: file.type || 'text/csv',\n    fileSize: fileBuffer.length,\n    entityType,\n    delimiter: preview.delimiter,\n    encoding: preview.encoding,\n    headers: preview.headers,\n    sampleRows: preview.sampleRows,\n    totalRows: preview.totalRows,\n    status: 'uploaded',\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n  })\n\n  em.persist(upload)\n  await em.flush()\n\n  await guarded.runAfterSuccess()\n\n  return NextResponse.json(syncExcelUploadResponseSchema.parse({\n    uploadId: upload.id,\n    filename: upload.filename,\n    mimeType: upload.mimeType,\n    fileSize: upload.fileSize,\n    entityType: upload.entityType,\n    headers: upload.headers,\n    sampleRows: upload.sampleRows,\n    totalRows: upload.totalRows,\n    suggestedMapping,\n  }))\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AACvC,SAAS,SAAS;AAClB,SAAS,+BAA+B,iCAAiC;AACzE,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,YAAY,0BAA0B,QAAQ,kBAAkB;AAClE,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,WAAW;AAAA,EAClB,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,8BAA8B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,6EAA6E,QAAQ,YAAY;AAAA,MAC/H;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,KAAK,SAAkB;AAC3C,QAAM,OAAO,MAAM,mBAAmB,OAAO;AAC7C,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM,8BAA8B,EAAE,MAAM,WAAW,QAAQ,CAAC;AACpF,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,GAAG,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EACvF;AACA,QAAM,EAAE,MAAM,IAAI;AAElB,QAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,QAAQ,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wCAAwC,OAAO;AAAA,EAClE,SAAS,OAAO;AACd,QAAI,4BAA4B,KAAK,GAAG;AACtC,aAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,UAAM;AAAA,EACR;AACA,QAAM,gBAAgB,gBAAgB,UAAU;AAAA,IAC9C,YAAY,OAAO,SAAS,IAAI,YAAY,MAAM,WAAW,SAAS,IAAI,YAAY,IAAI;AAAA,EAC5F,CAAC;AAED,MAAI,CAAC,cAAc,SAAS;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,QAAM,OAAO,SAAS,IAAI,MAAM;AAChC,MAAI,EAAE,gBAAgB,OAAO;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,qBAAqB,oBAAI,IAAI,CAAC,YAAY,4BAA4B,iBAAiB,CAAC;AAC9F,QAAM,cAAc,mBAAmB,IAAI,KAAK,IAAI;AACpD,QAAM,cAAc,KAAK,KAAK,YAAY,EAAE,SAAS,MAAM;AAE3D,MAAI,CAAC,eAAe,CAAC,aAAa;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,2DAA2D,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjH;AAEA,QAAM,iBAAiB,uCAAuC;AAC9D,MAAI,KAAK,OAAO,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,WAAW,WAAW;AAC5B,QAAM,kBAA2C;AAAA,IAC/C,YAAY,cAAc,KAAK;AAAA,IAC/B,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,UAAU,KAAK;AAAA,EACjB;AACA,QAAM,UAAU,MAAM,uBAAuB;AAAA,IAC3C;AAAA,IACA,KAAK;AAAA,IACL,MAAM,EAAE,QAAQ,KAAK,KAAK,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACzF,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,QAAM,iBAAiB,QAAQ,kBAC3B,gBAAgB,UAAU,EAAE,GAAG,iBAAiB,GAAG,QAAQ,gBAAgB,CAAC,IAC5E;AACJ,MAAI,CAAC,eAAe,SAAS;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,aAAa,eAAe,KAAK;AAEvC,QAAM,aAAa,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AACvD,QAAM,UAAU,gBAAgB,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1D,QAAM,mBAAmB,sBAAsB,YAAY,QAAQ,OAAO;AAE1E,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,MAAM,gCAAgC;AAAA,IACvD;AAAA,IACA;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,IACxC,IAAI;AAAA,IACJ,cAAc,WAAW;AAAA,IACzB,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,QAAQ;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB;AAAA,IACA,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,QAAQ;AAAA,IACR,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,EAClB,CAAC;AAED,KAAG,QAAQ,MAAM;AACjB,QAAM,GAAG,MAAM;AAEf,QAAM,QAAQ,gBAAgB;AAE9B,SAAO,aAAa,KAAK,8BAA8B,MAAM;AAAA,IAC3D,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB;AAAA,EACF,CAAC,CAAC;AACJ;",
   "names": []
 }

package/dist/modules/translations/api/context.js

@@ -1,6 +1,7 @@
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 function resolveTranslationsActorId(auth) {
   if (typeof auth.sub === "string" && auth.sub.trim().length > 0) return auth.sub;
@@ -18,7 +19,7 @@ async function resolveTranslationsRouteContext(req) {
   const em = container.resolve("em");
   const db = em.getKysely();
   const tenantId = scope?.tenantId ?? auth.tenantId;
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   const commandCtx = {
     container,
     auth,

package/dist/modules/translations/api/context.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/translations/api/context.ts"],
-  "sourcesContent": ["import { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { Kysely } from 'kysely'\n\nexport type TranslationsRouteContext = {\n  container: AwilixContainer\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  em: EntityManager\n  db: Kysely<any>\n  organizationId: string | null\n  tenantId: string\n  commandCtx: CommandRuntimeContext\n}\n\nexport function resolveTranslationsActorId(auth: TranslationsRouteContext['auth']): string {\n  if (typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function resolveTranslationsRouteContext(req: Request): Promise<TranslationsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = container.resolve('em') as EntityManager\n  const db = em.getKysely<any>()\n  const tenantId: string = scope?.tenantId ?? auth.tenantId\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    container,\n    auth,\n    em,\n    db,\n    organizationId,\n    tenantId,\n    commandCtx,\n  }\n}\n\nexport async function requireTranslationFeatures(\n  context: TranslationsRouteContext,\n  requiredFeatures: string[],\n): Promise<void> {\n  if (!requiredFeatures.length) return\n  const subject = context.auth.sub\n  if (!subject) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  const rbacService = context.container.resolve('rbacService') as {\n    userHasAllFeatures(\n      userId: string,\n      required: string[],\n      scope: { tenantId: string | null; organizationId: string | null },\n    ): Promise<boolean>\n  }\n  const hasFeatures = await rbacService.userHasAllFeatures(subject, requiredFeatures, {\n    tenantId: context.tenantId,\n    organizationId: context.organizationId,\n  })\n  if (!hasFeatures) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,qBAAqB;AAgBvB,SAAS,2BAA2B,MAAgD;AACzF,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC5E,MAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAClF,MAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAChF,SAAO;AACT;AAEA,eAAsB,gCAAgC,KAAiD;AACrG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,KAAK,GAAG,UAAe;AAC7B,QAAM,WAAmB,OAAO,YAAY,KAAK;AACjD,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAE1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,2BACpB,SACA,kBACe;AACf,MAAI,CAAC,iBAAiB,OAAQ;AAC9B,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,QAAM,cAAc,QAAQ,UAAU,QAAQ,aAAa;AAO3D,QAAM,cAAc,MAAM,YAAY,mBAAmB,SAAS,kBAAkB;AAAA,IAClF,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACF;",
+  "sourcesContent": ["import { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport type { Kysely } from 'kysely'\n\nexport type TranslationsRouteContext = {\n  container: AwilixContainer\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n  em: EntityManager\n  db: Kysely<any>\n  organizationId: string | null\n  tenantId: string\n  commandCtx: CommandRuntimeContext\n}\n\nexport function resolveTranslationsActorId(auth: TranslationsRouteContext['auth']): string {\n  if (typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub\n  if (typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId\n  if (typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId\n  return 'system'\n}\n\nexport async function resolveTranslationsRouteContext(req: Request): Promise<TranslationsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const em = container.resolve('em') as EntityManager\n  const db = em.getKysely<any>()\n  const tenantId: string = scope?.tenantId ?? auth.tenantId\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n\n  return {\n    container,\n    auth,\n    em,\n    db,\n    organizationId,\n    tenantId,\n    commandCtx,\n  }\n}\n\nexport async function requireTranslationFeatures(\n  context: TranslationsRouteContext,\n  requiredFeatures: string[],\n): Promise<void> {\n  if (!requiredFeatures.length) return\n  const subject = context.auth.sub\n  if (!subject) {\n    throw new CrudHttpError(401, { error: 'Unauthorized' })\n  }\n  const rbacService = context.container.resolve('rbacService') as {\n    userHasAllFeatures(\n      userId: string,\n      required: string[],\n      scope: { tenantId: string | null; organizationId: string | null },\n    ): Promise<boolean>\n  }\n  const hasFeatures = await rbacService.userHasAllFeatures(subject, requiredFeatures, {\n    tenantId: context.tenantId,\n    organizationId: context.organizationId,\n  })\n  if (!hasFeatures) {\n    throw new CrudHttpError(403, { error: 'Forbidden' })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,qBAAqB;AAgBvB,SAAS,2BAA2B,MAAgD;AACzF,MAAI,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAC5E,MAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAClF,MAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,KAAK;AAChF,SAAO;AACT;AAEA,eAAsB,gCAAgC,KAAiD;AACrG,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AAEA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,KAAK,GAAG,UAAe;AAC7B,QAAM,WAAmB,OAAO,YAAY,KAAK;AACjD,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AAEzE,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,2BACpB,SACA,kBACe;AACf,MAAI,CAAC,iBAAiB,OAAQ;AAC9B,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EACxD;AACA,QAAM,cAAc,QAAQ,UAAU,QAAQ,aAAa;AAO3D,QAAM,cAAc,MAAM,YAAY,mBAAmB,SAAS,kBAAkB;AAAA,IAClF,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EACrD;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/ai/assess/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -102,7 +103,7 @@ async function resolveAssessContext(req, translate) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required.") });
   }