@open-mercato/core 0.9.1-develop.7473.1.de5b22888f → 0.9.1-develop.7475.1.28ca93ed97

package/dist/helpers/integration/customerGroupsFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/customerGroupsFixtures.ts"],
-  "sourcesContent": ["import { randomInt } from 'node:crypto';\nimport { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\nconst GROUPS_PATH = '/api/customer_groups/customer-groups';\nconst MEMBERSHIPS_PATH = '/api/customer_groups/customer-groups/memberships';\n\n/**\n * `CustomerGroup.priority` is unique per tenant among live rows (partial\n * unique index `customer_groups_tenant_priority_unique`), and integration\n * specs share one admin tenant. A fixed default would collide with any live\n * group already holding that value, so callers that do not care about the\n * exact priority get a random value from a band no product flow writes\n * (reorder writes 10, 20, ...; the TC-CGRP `fixturePriority` band is\n * 2,000,000-2,999,999).\n */\nexport function uniqueCustomerGroupPriority(): number {\n  return 3_000_000 + randomInt(0, 1_000_000_000);\n}\n\nexport type CustomerGroupFixtureInput = {\n  code: string;\n  name: string;\n  kind?: 'b2c' | 'b2b' | 'internal' | 'partner';\n  priority?: number;\n  isDefault?: boolean;\n  isActive?: boolean;\n  parentId?: string;\n};\n\nexport async function createCustomerGroupFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupFixtureInput,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', GROUPS_PATH, {\n    token,\n    data: {\n      code: input.code,\n      name: input.name,\n      kind: input.kind ?? 'b2c',\n      priority: input.priority ?? uniqueCustomerGroupPriority(),\n      isDefault: input.isDefault ?? false,\n      isActive: input.isActive ?? true,\n      ...(input.parentId ? { parentId: input.parentId } : {}),\n    },\n  });\n  expect(response.status(), `create customer group fixture failed: ${response.status()}`).toBe(201);\n  return expectId(\n    (await readJsonSafe<{ id?: string }>(response))?.id,\n    'customer group fixture should return an id',\n  );\n}\n\nexport async function deleteCustomerGroupIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  groupId: string | null,\n): Promise<void> {\n  if (!token || !groupId) return;\n  await apiRequest(request, 'DELETE', `${GROUPS_PATH}?id=${encodeURIComponent(groupId)}`, { token }).catch(\n    () => undefined,\n  );\n}\n\nexport type CustomerGroupMembershipFixtureInput = {\n  groupId: string;\n  customerId: string;\n  source?: 'manual' | 'import' | 'rule' | 'onboarding';\n  validFrom?: string;\n  validUntil?: string;\n};\n\nexport async function createCustomerGroupMembershipFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupMembershipFixtureInput,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', MEMBERSHIPS_PATH, {\n    token,\n    data: {\n      groupId: input.groupId,\n      customerId: input.customerId,\n      source: input.source ?? 'manual',\n      ...(input.validFrom ? { validFrom: input.validFrom } : {}),\n      ...(input.validUntil ? { validUntil: input.validUntil } : {}),\n    },\n  });\n  expect(response.status(), `create customer group membership fixture failed: ${response.status()}`).toBe(201);\n  return expectId(\n    (await readJsonSafe<{ id?: string }>(response))?.id,\n    'customer group membership fixture should return an id',\n  );\n}\n\nexport async function deleteCustomerGroupMembershipIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  membershipId: string | null,\n): Promise<void> {\n  if (!token || !membershipId) return;\n  await apiRequest(request, 'DELETE', `${MEMBERSHIPS_PATH}?id=${encodeURIComponent(membershipId)}`, {\n    token,\n  }).catch(() => undefined);\n}\n\nexport type CustomerGroupTermsFixtureInput = {\n  groupId: string;\n  priceKindId?: string | null;\n  paymentTermsDays?: number | null;\n  allowPurchaseOnAccount?: boolean;\n  defaultCreditLimit?: number | null;\n  creditCurrencyCode?: string | null;\n  approvalRequiredAbove?: number | null;\n  minOrderValue?: number | null;\n  metadata?: Record<string, unknown> | null;\n};\n\nexport type CustomerGroupTermsFixtureResult = {\n  id: string;\n  updatedAt: string;\n};\n\n/**\n * Upserts (`PUT /api/customer_groups/customer-groups/:id/terms`) the target group's commercial\n * terms row. Mirrors `createCustomerGroupFixture`'s shape but returns\n * `{ id, updatedAt }` instead of a bare id \u2014 callers exercising optimistic\n * locking need the row's `updatedAt` immediately after create/update without\n * an extra GET round-trip.\n */\nexport async function createCustomerGroupTermsFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupTermsFixtureInput,\n  headers: Record<string, string> = {},\n): Promise<CustomerGroupTermsFixtureResult> {\n  const { groupId, ...fields } = input;\n  const data: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (value !== undefined) data[key] = value;\n  }\n  const response = await apiRequest(request, 'PUT', `${GROUPS_PATH}/${groupId}/terms`, {\n    token,\n    data,\n    headers,\n  });\n  expect(response.status(), `create/update customer group terms fixture failed: ${response.status()}`).toBe(200);\n  const body = await readJsonSafe<{ terms?: { id?: string; updatedAt?: string } }>(response);\n  return {\n    id: expectId(body?.terms?.id, 'customer group terms fixture should return an id'),\n    updatedAt: expectId(body?.terms?.updatedAt, 'customer group terms fixture should return updatedAt'),\n  };\n}\n\n/**\n * `CustomerGroupTerms` has no standalone DELETE endpoint \u2014 `GET/PUT\n * /api/customer_groups/customer-groups/:id/terms` only (see the doc comment on that route:\n * terms are a strict 1:1 sub-resource of a group with no independent\n * list/create/delete semantics). Deleting the PARENT group via\n * `deleteCustomerGroupIfExists` is what actually reclaims a terms row in\n * tests. This no-op exists only for naming symmetry with the other\n * `delete*IfExists` helpers so a spec's `finally` block reads consistently.\n */\nexport async function deleteCustomerGroupTermsIfExists(\n  _request: APIRequestContext,\n  _token: string | null,\n  _groupId: string | null,\n): Promise<void> {\n  return undefined;\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB;AAC1B,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAEvC,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAWlB,SAAS,8BAAsC;AACpD,SAAO,MAAY,UAAU,GAAG,GAAa;AAC/C;AAYA,eAAsB,2BACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,aAAa;AAAA,IAC9D;AAAA,IACA,MAAM;AAAA,MACJ,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM,QAAQ;AAAA,MACpB,UAAU,MAAM,YAAY,4BAA4B;AAAA,MACxD,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,MAAM,YAAY;AAAA,MAC5B,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,yCAAyC,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAChG,SAAO;AAAA,KACJ,MAAM,aAA8B,QAAQ,IAAI;AAAA,IACjD;AAAA,EACF;AACF;AAEA,eAAsB,4BACpB,SACA,OACA,SACe;AACf,MAAI,CAAC,SAAS,CAAC,QAAS;AACxB,QAAM,WAAW,SAAS,UAAU,GAAG,WAAW,OAAO,mBAAmB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;AAAA,IACjG,MAAM;AAAA,EACR;AACF;AAUA,eAAsB,qCACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,IACnE;AAAA,IACA,MAAM;AAAA,MACJ,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM,UAAU;AAAA,MACxB,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,oDAAoD,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAC3G,SAAO;AAAA,KACJ,MAAM,aAA8B,QAAQ,IAAI;AAAA,IACjD;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,SACA,OACA,cACe;AACf,MAAI,CAAC,SAAS,CAAC,aAAc;AAC7B,QAAM,WAAW,SAAS,UAAU,GAAG,gBAAgB,OAAO,mBAAmB,YAAY,CAAC,IAAI;AAAA,IAChG;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AA0BA,eAAsB,gCACpB,SACA,OACA,OACA,UAAkC,CAAC,GACO;AAC1C,QAAM,EAAE,SAAS,GAAG,OAAO,IAAI;AAC/B,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,EACvC;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,GAAG,WAAW,IAAI,OAAO,UAAU;AAAA,IACnF;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,sDAAsD,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAC7G,QAAM,OAAO,MAAM,aAA8D,QAAQ;AACzF,SAAO;AAAA,IACL,IAAI,SAAS,MAAM,OAAO,IAAI,kDAAkD;AAAA,IAChF,WAAW,SAAS,MAAM,OAAO,WAAW,sDAAsD;AAAA,EACpG;AACF;AAWA,eAAsB,iCACpB,UACA,QACA,UACe;AACf,SAAO;AACT;",
+  "sourcesContent": ["import { randomInt } from 'node:crypto';\nimport { expect, type APIRequestContext } from '@playwright/test';\nimport type { AssortmentScope } from '@open-mercato/shared/lib/catalog-visibility';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\nconst GROUPS_PATH = '/api/customer_groups/customer-groups';\nconst MEMBERSHIPS_PATH = '/api/customer_groups/customer-groups/memberships';\n\n/**\n * `CustomerGroup.priority` is unique per tenant among live rows (partial\n * unique index `customer_groups_tenant_priority_unique`), and integration\n * specs share one admin tenant. A fixed default would collide with any live\n * group already holding that value, so callers that do not care about the\n * exact priority get a random value from a band no product flow writes\n * (reorder writes 10, 20, ...; the TC-CGRP `fixturePriority` band is\n * 2,000,000-2,999,999).\n */\nexport function uniqueCustomerGroupPriority(): number {\n  return 3_000_000 + randomInt(0, 1_000_000_000);\n}\n\nexport type CustomerGroupFixtureInput = {\n  code: string;\n  name: string;\n  kind?: 'b2c' | 'b2b' | 'internal' | 'partner';\n  priority?: number;\n  isDefault?: boolean;\n  isActive?: boolean;\n  parentId?: string;\n};\n\nexport async function createCustomerGroupFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupFixtureInput,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', GROUPS_PATH, {\n    token,\n    data: {\n      code: input.code,\n      name: input.name,\n      kind: input.kind ?? 'b2c',\n      priority: input.priority ?? uniqueCustomerGroupPriority(),\n      isDefault: input.isDefault ?? false,\n      isActive: input.isActive ?? true,\n      ...(input.parentId ? { parentId: input.parentId } : {}),\n    },\n  });\n  expect(response.status(), `create customer group fixture failed: ${response.status()}`).toBe(201);\n  return expectId(\n    (await readJsonSafe<{ id?: string }>(response))?.id,\n    'customer group fixture should return an id',\n  );\n}\n\nexport async function deleteCustomerGroupIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  groupId: string | null,\n): Promise<void> {\n  if (!token || !groupId) return;\n  await apiRequest(request, 'DELETE', `${GROUPS_PATH}?id=${encodeURIComponent(groupId)}`, { token }).catch(\n    () => undefined,\n  );\n}\n\nexport type CustomerGroupMembershipFixtureInput = {\n  groupId: string;\n  customerId: string;\n  source?: 'manual' | 'import' | 'rule' | 'onboarding';\n  validFrom?: string;\n  validUntil?: string;\n};\n\nexport async function createCustomerGroupMembershipFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupMembershipFixtureInput,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', MEMBERSHIPS_PATH, {\n    token,\n    data: {\n      groupId: input.groupId,\n      customerId: input.customerId,\n      source: input.source ?? 'manual',\n      ...(input.validFrom ? { validFrom: input.validFrom } : {}),\n      ...(input.validUntil ? { validUntil: input.validUntil } : {}),\n    },\n  });\n  expect(response.status(), `create customer group membership fixture failed: ${response.status()}`).toBe(201);\n  return expectId(\n    (await readJsonSafe<{ id?: string }>(response))?.id,\n    'customer group membership fixture should return an id',\n  );\n}\n\nexport async function deleteCustomerGroupMembershipIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  membershipId: string | null,\n): Promise<void> {\n  if (!token || !membershipId) return;\n  await apiRequest(request, 'DELETE', `${MEMBERSHIPS_PATH}?id=${encodeURIComponent(membershipId)}`, {\n    token,\n  }).catch(() => undefined);\n}\n\nexport type CustomerGroupTermsFixtureInput = {\n  groupId: string;\n  priceKindId?: string | null;\n  paymentTermsDays?: number | null;\n  allowPurchaseOnAccount?: boolean;\n  defaultCreditLimit?: number | null;\n  creditCurrencyCode?: string | null;\n  approvalRequiredAbove?: number | null;\n  minOrderValue?: number | null;\n  assortmentScope?: AssortmentScope | null;\n  metadata?: Record<string, unknown> | null;\n};\n\nexport type CustomerGroupTermsFixtureResult = {\n  id: string;\n  updatedAt: string;\n};\n\n/**\n * Upserts (`PUT /api/customer_groups/customer-groups/:id/terms`) the target group's commercial\n * terms row. Mirrors `createCustomerGroupFixture`'s shape but returns\n * `{ id, updatedAt }` instead of a bare id \u2014 callers exercising optimistic\n * locking need the row's `updatedAt` immediately after create/update without\n * an extra GET round-trip.\n */\nexport async function createCustomerGroupTermsFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CustomerGroupTermsFixtureInput,\n  headers: Record<string, string> = {},\n): Promise<CustomerGroupTermsFixtureResult> {\n  const { groupId, ...fields } = input;\n  const data: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(fields)) {\n    if (value !== undefined) data[key] = value;\n  }\n  const response = await apiRequest(request, 'PUT', `${GROUPS_PATH}/${groupId}/terms`, {\n    token,\n    data,\n    headers,\n  });\n  expect(response.status(), `create/update customer group terms fixture failed: ${response.status()}`).toBe(200);\n  const body = await readJsonSafe<{ terms?: { id?: string; updatedAt?: string } }>(response);\n  return {\n    id: expectId(body?.terms?.id, 'customer group terms fixture should return an id'),\n    updatedAt: expectId(body?.terms?.updatedAt, 'customer group terms fixture should return updatedAt'),\n  };\n}\n\n/**\n * `CustomerGroupTerms` has no standalone DELETE endpoint \u2014 `GET/PUT\n * /api/customer_groups/customer-groups/:id/terms` only (see the doc comment on that route:\n * terms are a strict 1:1 sub-resource of a group with no independent\n * list/create/delete semantics). Deleting the PARENT group via\n * `deleteCustomerGroupIfExists` is what actually reclaims a terms row in\n * tests. This no-op exists only for naming symmetry with the other\n * `delete*IfExists` helpers so a spec's `finally` block reads consistently.\n */\nexport async function deleteCustomerGroupTermsIfExists(\n  _request: APIRequestContext,\n  _token: string | null,\n  _groupId: string | null,\n): Promise<void> {\n  return undefined;\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAC1B,SAAS,cAAsC;AAE/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAEvC,MAAM,cAAc;AACpB,MAAM,mBAAmB;AAWlB,SAAS,8BAAsC;AACpD,SAAO,MAAY,UAAU,GAAG,GAAa;AAC/C;AAYA,eAAsB,2BACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,aAAa;AAAA,IAC9D;AAAA,IACA,MAAM;AAAA,MACJ,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM,QAAQ;AAAA,MACpB,UAAU,MAAM,YAAY,4BAA4B;AAAA,MACxD,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,MAAM,YAAY;AAAA,MAC5B,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,yCAAyC,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAChG,SAAO;AAAA,KACJ,MAAM,aAA8B,QAAQ,IAAI;AAAA,IACjD;AAAA,EACF;AACF;AAEA,eAAsB,4BACpB,SACA,OACA,SACe;AACf,MAAI,CAAC,SAAS,CAAC,QAAS;AACxB,QAAM,WAAW,SAAS,UAAU,GAAG,WAAW,OAAO,mBAAmB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;AAAA,IACjG,MAAM;AAAA,EACR;AACF;AAUA,eAAsB,qCACpB,SACA,OACA,OACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,IACnE;AAAA,IACA,MAAM;AAAA,MACJ,SAAS,MAAM;AAAA,MACf,YAAY,MAAM;AAAA,MAClB,QAAQ,MAAM,UAAU;AAAA,MACxB,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,MACxD,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAC7D;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,oDAAoD,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAC3G,SAAO;AAAA,KACJ,MAAM,aAA8B,QAAQ,IAAI;AAAA,IACjD;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,SACA,OACA,cACe;AACf,MAAI,CAAC,SAAS,CAAC,aAAc;AAC7B,QAAM,WAAW,SAAS,UAAU,GAAG,gBAAgB,OAAO,mBAAmB,YAAY,CAAC,IAAI;AAAA,IAChG;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AA2BA,eAAsB,gCACpB,SACA,OACA,OACA,UAAkC,CAAC,GACO;AAC1C,QAAM,EAAE,SAAS,GAAG,OAAO,IAAI;AAC/B,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,QAAI,UAAU,OAAW,MAAK,GAAG,IAAI;AAAA,EACvC;AACA,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,GAAG,WAAW,IAAI,OAAO,UAAU;AAAA,IACnF;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,sDAAsD,SAAS,OAAO,CAAC,EAAE,EAAE,KAAK,GAAG;AAC7G,QAAM,OAAO,MAAM,aAA8D,QAAQ;AACzF,SAAO;AAAA,IACL,IAAI,SAAS,MAAM,OAAO,IAAI,kDAAkD;AAAA,IAChF,WAAW,SAAS,MAAM,OAAO,WAAW,sDAAsD;AAAA,EACpG;AACF;AAWA,eAAsB,iCACpB,UACA,QACA,UACe;AACf,SAAO;AACT;",
   "names": []
 }

package/dist/modules/catalog/acl.js

@@ -30,7 +30,14 @@ const features = [
     module: "catalog",
     dependsOn: ["catalog.products.view", "currencies.view"]
   },
-  { id: "catalog.settings.manage", title: "Manage catalog settings", module: "catalog" }
+  { id: "catalog.settings.view", title: "View catalog settings", module: "catalog" },
+  { id: "catalog.settings.manage", title: "Manage catalog settings", module: "catalog" },
+  {
+    id: "catalog.price_history.view",
+    title: "View catalog price history",
+    module: "catalog",
+    dependsOn: ["catalog.products.view"]
+  }
 ];
 var acl_default = features;
 export {

package/dist/modules/catalog/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/catalog/acl.ts"],
-  "sourcesContent": ["export const features = [\n  {\n    id: 'catalog.products.view',\n    title: 'View catalog products',\n    module: 'catalog',\n    dependsOn: ['currencies.view', 'dictionaries.view'],\n  },\n  {\n    id: 'catalog.products.manage',\n    title: 'Manage catalog products',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view'],\n  },\n  { id: 'catalog.categories.view', title: 'View catalog categories', module: 'catalog' },\n  {\n    id: 'catalog.categories.manage',\n    title: 'Manage catalog categories',\n    module: 'catalog',\n    dependsOn: ['catalog.categories.view'],\n  },\n  {\n    id: 'catalog.variants.manage',\n    title: 'Manage catalog variants',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view'],\n  },\n  {\n    id: 'catalog.pricing.manage',\n    title: 'Manage catalog pricing',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view', 'currencies.view'],\n  },\n  { id: 'catalog.settings.manage', title: 'Manage catalog settings', module: 'catalog' },\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,mBAAmB,mBAAmB;AAAA,EACpD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,uBAAuB;AAAA,EACrC;AAAA,EACA,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,UAAU;AAAA,EACrF;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,yBAAyB;AAAA,EACvC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,yBAAyB,iBAAiB;AAAA,EACxD;AAAA,EACA,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,UAAU;AACvF;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  {\n    id: 'catalog.products.view',\n    title: 'View catalog products',\n    module: 'catalog',\n    dependsOn: ['currencies.view', 'dictionaries.view'],\n  },\n  {\n    id: 'catalog.products.manage',\n    title: 'Manage catalog products',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view'],\n  },\n  { id: 'catalog.categories.view', title: 'View catalog categories', module: 'catalog' },\n  {\n    id: 'catalog.categories.manage',\n    title: 'Manage catalog categories',\n    module: 'catalog',\n    dependsOn: ['catalog.categories.view'],\n  },\n  {\n    id: 'catalog.variants.manage',\n    title: 'Manage catalog variants',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view'],\n  },\n  {\n    id: 'catalog.pricing.manage',\n    title: 'Manage catalog pricing',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view', 'currencies.view'],\n  },\n  { id: 'catalog.settings.view', title: 'View catalog settings', module: 'catalog' },\n  { id: 'catalog.settings.manage', title: 'Manage catalog settings', module: 'catalog' },\n  {\n    id: 'catalog.price_history.view',\n    title: 'View catalog price history',\n    module: 'catalog',\n    dependsOn: ['catalog.products.view'],\n  },\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,mBAAmB,mBAAmB;AAAA,EACpD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,uBAAuB;AAAA,EACrC;AAAA,EACA,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,UAAU;AAAA,EACrF;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,yBAAyB;AAAA,EACvC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,uBAAuB;AAAA,EACrC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,yBAAyB,iBAAiB;AAAA,EACxD;AAAA,EACA,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,UAAU;AAAA,EACjF,EAAE,IAAI,2BAA2B,OAAO,2BAA2B,QAAQ,UAAU;AAAA,EACrF;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,uBAAuB;AAAA,EACrC;AACF;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/catalog/api/config/omnibus/route.js

@@ -0,0 +1,184 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  bridgeLegacyGuard,
+  runMutationGuards
+} from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { getAllMutationGuardInstances } from "@open-mercato/shared/lib/crud/mutation-guard-store";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { omnibusConfigPatchSchema } from "../../../data/validators.js";
+import { OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, omnibusConfigSchema } from "../../../lib/omnibusTypes.js";
+import {
+  buildOmnibusFieldErrors,
+  evaluateOmnibusConfig,
+  invalidOmnibusConfig,
+  mergeOmnibusConfig,
+  parseStoredOmnibusConfig
+} from "../../../lib/omnibusConfig.js";
+import { invalidateOmnibusTenantCache, resolveOmnibusCache } from "../../../lib/omnibusCache.js";
+const logger = createLogger("catalog");
+const OMNIBUS_CONFIG_RESOURCE_KIND = "catalog.settings";
+const OMNIBUS_CONFIG_READ_FEATURES = ["catalog.settings.view", "catalog.settings.manage"];
+const metadata = {
+  GET: { requireAuth: true },
+  PATCH: { requireAuth: true, requireFeatures: ["catalog.settings.manage"] }
+};
+function resolveUserFeatures(auth) {
+  const features = auth?.features;
+  if (!Array.isArray(features)) return [];
+  return features.filter((value) => typeof value === "string");
+}
+async function readStoredConfig(service, tenantId) {
+  const raw = await service.getValue(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, { scope: { tenantId } });
+  const config = parseStoredOmnibusConfig(raw);
+  if (raw !== null && raw !== void 0 && !config) {
+    logger.warn("[internal] catalog omnibus stored config is invalid; treating it as unset", { tenantId });
+  }
+  return config;
+}
+function evaluatePatch(existing, payload) {
+  const parsed = omnibusConfigPatchSchema.safeParse(payload);
+  if (!parsed.success) return invalidOmnibusConfig(buildOmnibusFieldErrors(parsed.error.issues));
+  return { ...evaluateOmnibusConfig(mergeOmnibusConfig(existing, parsed.data)), patch: parsed.data };
+}
+async function GET(req) {
+  try {
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const container = await createRequestContainer();
+    const rbacService = container.resolve("rbacService");
+    const scope = { tenantId: auth.tenantId, organizationId: auth.orgId ?? null };
+    let canRead = false;
+    for (const feature of OMNIBUS_CONFIG_READ_FEATURES) {
+      if (await rbacService.userHasAllFeatures(auth.sub, [feature], scope)) {
+        canRead = true;
+        break;
+      }
+    }
+    if (!canRead) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    const service = container.resolve("moduleConfigService");
+    const config = await readStoredConfig(service, auth.tenantId);
+    return NextResponse.json(config ?? {});
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    logger.error("catalog.config.omnibus.GET failed", { err });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+async function PATCH(req) {
+  try {
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const tenantId = auth.tenantId;
+    const organizationId = auth.orgId ?? null;
+    let body;
+    try {
+      body = await req.json();
+    } catch {
+      return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
+    }
+    const container = await createRequestContainer();
+    const service = container.resolve("moduleConfigService");
+    const existing = await readStoredConfig(service, tenantId);
+    let evaluation = evaluatePatch(existing, body);
+    if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status });
+    const legacyGuard = bridgeLegacyGuard(container);
+    const guards = [...getAllMutationGuardInstances()];
+    if (legacyGuard) guards.push(legacyGuard);
+    const guardInput = {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? "",
+      resourceKind: OMNIBUS_CONFIG_RESOURCE_KIND,
+      resourceId: OMNIBUS_CONFIG_NAME,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    };
+    const guardResult = await runMutationGuards(
+      guards,
+      { ...guardInput, mutationPayload: evaluation.patch ?? null },
+      { userFeatures: resolveUserFeatures(auth) }
+    );
+    if (!guardResult.ok) {
+      return NextResponse.json(guardResult.errorBody ?? { error: "Operation blocked by guard" }, {
+        status: guardResult.errorStatus ?? 422
+      });
+    }
+    if (guardResult.modifiedPayload) {
+      evaluation = evaluatePatch(existing, { ...evaluation.patch, ...guardResult.modifiedPayload });
+      if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status });
+    }
+    const nextConfig = evaluation.config;
+    await service.setValue(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, nextConfig, { tenantId });
+    await invalidateOmnibusTenantCache(resolveOmnibusCache(container), tenantId);
+    for (const callback of guardResult.afterSuccessCallbacks) {
+      if (!callback.guard.afterSuccess) continue;
+      try {
+        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null });
+      } catch (callbackError) {
+        logger.error("Mutation guard afterSuccess callback failed", {
+          component: "catalog.config.omnibus",
+          guardId: callback.guard.id,
+          err: callbackError
+        });
+      }
+    }
+    return NextResponse.json(nextConfig);
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    logger.error("catalog.config.omnibus.PATCH failed", { err });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const errorSchema = z.object({ error: z.string() }).passthrough();
+const invalidConfigSchema = z.object({
+  error: z.literal("Invalid config"),
+  details: z.object({ fieldErrors: z.record(z.string(), z.array(z.string())) })
+});
+const backfillRequiredSchema = z.object({
+  field: z.literal("enabled"),
+  error: z.literal("backfill_required_before_enable"),
+  channels: z.array(z.string())
+});
+const openApi = {
+  tag: "Catalog",
+  summary: "Omnibus price-reference configuration",
+  methods: {
+    GET: {
+      summary: "Read the tenant Omnibus configuration",
+      description: "Returns the tenant-scoped Omnibus configuration with defaults applied, or an empty object when it has never been configured.",
+      tags: ["Catalog"],
+      responses: [
+        { status: 200, description: "Tenant Omnibus configuration ({} when unset)", schema: omnibusConfigSchema.partial() }
+      ],
+      errors: [{ status: 401, description: "Unauthorized", schema: errorSchema }]
+    },
+    PATCH: {
+      summary: "Update the tenant Omnibus configuration",
+      description: "Shallow-merges the provided top-level fields into the stored tenant configuration (a provided `channels` map replaces the stored one; `null` clears `defaultPresentedPriceKindId`). Member-state derogation fields and `backfillCoverage` are rejected. Enabling requires a resolvable presented price kind and completed backfill coverage for every in-scope EU channel.",
+      tags: ["Catalog"],
+      requestBody: { schema: omnibusConfigPatchSchema },
+      responses: [{ status: 200, description: "Merged Omnibus configuration", schema: omnibusConfigSchema }],
+      errors: [
+        { status: 400, description: "Invalid JSON body or invalid config", schema: invalidConfigSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 422, description: "Backfill required before enabling, or blocked by a mutation guard", schema: backfillRequiredSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/catalog/api/config/omnibus/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/catalog/api/config/omnibus/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { getAllMutationGuardInstances } from '@open-mercato/shared/lib/crud/mutation-guard-store'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { omnibusConfigPatchSchema, type OmnibusConfigPatch } from '../../../data/validators'\nimport { OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, omnibusConfigSchema, type OmnibusConfig } from '../../../lib/omnibusTypes'\nimport {\n  buildOmnibusFieldErrors,\n  evaluateOmnibusConfig,\n  invalidOmnibusConfig,\n  mergeOmnibusConfig,\n  parseStoredOmnibusConfig,\n  type OmnibusConfigEvaluation,\n} from '../../../lib/omnibusConfig'\nimport { invalidateOmnibusTenantCache, resolveOmnibusCache } from '../../../lib/omnibusCache'\n\nconst logger = createLogger('catalog')\n\nconst OMNIBUS_CONFIG_RESOURCE_KIND = 'catalog.settings'\n\nconst OMNIBUS_CONFIG_READ_FEATURES = ['catalog.settings.view', 'catalog.settings.manage'] as const\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PATCH: { requireAuth: true, requireFeatures: ['catalog.settings.manage'] },\n}\n\nfunction resolveUserFeatures(auth: unknown): string[] {\n  const features = (auth as { features?: unknown })?.features\n  if (!Array.isArray(features)) return []\n  return features.filter((value): value is string => typeof value === 'string')\n}\n\nasync function readStoredConfig(service: ModuleConfigService, tenantId: string): Promise<OmnibusConfig | null> {\n  const raw = await service.getValue<unknown>(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, { scope: { tenantId } })\n  const config = parseStoredOmnibusConfig(raw)\n  if (raw !== null && raw !== undefined && !config) {\n    logger.warn('[internal] catalog omnibus stored config is invalid; treating it as unset', { tenantId })\n  }\n  return config\n}\n\nfunction evaluatePatch(existing: OmnibusConfig | null, payload: unknown): OmnibusConfigEvaluation & { patch?: OmnibusConfigPatch } {\n  const parsed = omnibusConfigPatchSchema.safeParse(payload)\n  if (!parsed.success) return invalidOmnibusConfig(buildOmnibusFieldErrors(parsed.error.issues))\n  return { ...evaluateOmnibusConfig(mergeOmnibusConfig(existing, parsed.data)), patch: parsed.data }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const container = await createRequestContainer()\n    const rbacService = container.resolve('rbacService') as RbacService\n    const scope = { tenantId: auth.tenantId, organizationId: auth.orgId ?? null }\n    let canRead = false\n    for (const feature of OMNIBUS_CONFIG_READ_FEATURES) {\n      if (await rbacService.userHasAllFeatures(auth.sub, [feature], scope)) {\n        canRead = true\n        break\n      }\n    }\n    if (!canRead) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    const service = container.resolve('moduleConfigService') as ModuleConfigService\n    const config = await readStoredConfig(service, auth.tenantId)\n    return NextResponse.json(config ?? {})\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('catalog.config.omnibus.GET failed', { err })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    const tenantId = auth.tenantId\n    const organizationId = auth.orgId ?? null\n\n    let body: unknown\n    try {\n      body = await req.json()\n    } catch {\n      return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n    }\n\n    const container = await createRequestContainer()\n    const service = container.resolve('moduleConfigService') as ModuleConfigService\n    const existing = await readStoredConfig(service, tenantId)\n\n    let evaluation = evaluatePatch(existing, body)\n    if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status })\n\n    const legacyGuard = bridgeLegacyGuard(container)\n    const guards: MutationGuard[] = [...getAllMutationGuardInstances()]\n    if (legacyGuard) guards.push(legacyGuard)\n    const guardInput = {\n      tenantId,\n      organizationId,\n      userId: auth.sub ?? '',\n      resourceKind: OMNIBUS_CONFIG_RESOURCE_KIND,\n      resourceId: OMNIBUS_CONFIG_NAME,\n      operation: 'update' as const,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    }\n    const guardResult = await runMutationGuards(\n      guards,\n      { ...guardInput, mutationPayload: evaluation.patch ?? null },\n      { userFeatures: resolveUserFeatures(auth) },\n    )\n    if (!guardResult.ok) {\n      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {\n        status: guardResult.errorStatus ?? 422,\n      })\n    }\n    if (guardResult.modifiedPayload) {\n      evaluation = evaluatePatch(existing, { ...evaluation.patch, ...guardResult.modifiedPayload })\n      if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status })\n    }\n\n    const nextConfig = evaluation.config\n    // optimistic-lock-exempt: single tenant-scoped config blob merged server-side; no per-record version to compare\n    await service.setValue(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, nextConfig, { tenantId })\n    await invalidateOmnibusTenantCache(resolveOmnibusCache(container), tenantId)\n\n    for (const callback of guardResult.afterSuccessCallbacks) {\n      if (!callback.guard.afterSuccess) continue\n      try {\n        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null })\n      } catch (callbackError) {\n        logger.error('Mutation guard afterSuccess callback failed', {\n          component: 'catalog.config.omnibus',\n          guardId: callback.guard.id,\n          err: callbackError,\n        })\n      }\n    }\n\n    return NextResponse.json(nextConfig)\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('catalog.config.omnibus.PATCH failed', { err })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst errorSchema = z.object({ error: z.string() }).passthrough()\n\nconst invalidConfigSchema = z.object({\n  error: z.literal('Invalid config'),\n  details: z.object({ fieldErrors: z.record(z.string(), z.array(z.string())) }),\n})\n\nconst backfillRequiredSchema = z.object({\n  field: z.literal('enabled'),\n  error: z.literal('backfill_required_before_enable'),\n  channels: z.array(z.string()),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Catalog',\n  summary: 'Omnibus price-reference configuration',\n  methods: {\n    GET: {\n      summary: 'Read the tenant Omnibus configuration',\n      description: 'Returns the tenant-scoped Omnibus configuration with defaults applied, or an empty object when it has never been configured.',\n      tags: ['Catalog'],\n      responses: [\n        { status: 200, description: 'Tenant Omnibus configuration ({} when unset)', schema: omnibusConfigSchema.partial() },\n      ],\n      errors: [{ status: 401, description: 'Unauthorized', schema: errorSchema }],\n    },\n    PATCH: {\n      summary: 'Update the tenant Omnibus configuration',\n      description:\n        'Shallow-merges the provided top-level fields into the stored tenant configuration (a provided `channels` map replaces the stored one; `null` clears `defaultPresentedPriceKindId`). Member-state derogation fields and `backfillCoverage` are rejected. Enabling requires a resolvable presented price kind and completed backfill coverage for every in-scope EU channel.',\n      tags: ['Catalog'],\n      requestBody: { schema: omnibusConfigPatchSchema },\n      responses: [{ status: 200, description: 'Merged Omnibus configuration', schema: omnibusConfigSchema }],\n      errors: [\n        { status: 400, description: 'Invalid JSON body or invalid config', schema: invalidConfigSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 422, description: 'Backfill required before enabling, or blocked by a mutation guard', schema: backfillRequiredSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAI7B,SAAS,gCAAyD;AAClE,SAAS,0BAA0B,qBAAqB,2BAA+C;AACvG;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,8BAA8B,2BAA2B;AAElE,MAAM,SAAS,aAAa,SAAS;AAErC,MAAM,+BAA+B;AAErC,MAAM,+BAA+B,CAAC,yBAAyB,yBAAyB;AAEjF,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,yBAAyB,EAAE;AAC3E;AAEA,SAAS,oBAAoB,MAAyB;AACpD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AACtC,SAAO,SAAS,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAC9E;AAEA,eAAe,iBAAiB,SAA8B,UAAiD;AAC7G,QAAM,MAAM,MAAM,QAAQ,SAAkB,0BAA0B,qBAAqB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAClH,QAAM,SAAS,yBAAyB,GAAG;AAC3C,MAAI,QAAQ,QAAQ,QAAQ,UAAa,CAAC,QAAQ;AAChD,WAAO,KAAK,6EAA6E,EAAE,SAAS,CAAC;AAAA,EACvG;AACA,SAAO;AACT;AAEA,SAAS,cAAc,UAAgC,SAA4E;AACjI,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,QAAS,QAAO,qBAAqB,wBAAwB,OAAO,MAAM,MAAM,CAAC;AAC7F,SAAO,EAAE,GAAG,sBAAsB,mBAAmB,UAAU,OAAO,IAAI,CAAC,GAAG,OAAO,OAAO,KAAK;AACnG;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,QAAQ,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,SAAS,KAAK;AAC5E,QAAI,UAAU;AACd,eAAW,WAAW,8BAA8B;AAClD,UAAI,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,OAAO,GAAG,KAAK,GAAG;AACpE,kBAAU;AACV;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,UAAM,UAAU,UAAU,QAAQ,qBAAqB;AACvD,UAAM,SAAS,MAAM,iBAAiB,SAAS,KAAK,QAAQ;AAC5D,WAAO,aAAa,KAAK,UAAU,CAAC,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,UAAM,WAAW,KAAK;AACtB,UAAM,iBAAiB,KAAK,SAAS;AAErC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,IAAI,KAAK;AAAA,IACxB,QAAQ;AACN,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,qBAAqB;AACvD,UAAM,WAAW,MAAM,iBAAiB,SAAS,QAAQ;AAEzD,QAAI,aAAa,cAAc,UAAU,IAAI;AAC7C,QAAI,CAAC,WAAW,GAAI,QAAO,aAAa,KAAK,WAAW,MAAM,EAAE,QAAQ,WAAW,OAAO,CAAC;AAE3F,UAAM,cAAc,kBAAkB,SAAS;AAC/C,UAAM,SAA0B,CAAC,GAAG,6BAA6B,CAAC;AAClE,QAAI,YAAa,QAAO,KAAK,WAAW;AACxC,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB;AACA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA,EAAE,GAAG,YAAY,iBAAiB,WAAW,SAAS,KAAK;AAAA,MAC3D,EAAE,cAAc,oBAAoB,IAAI,EAAE;AAAA,IAC5C;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,aAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG;AAAA,QACzF,QAAQ,YAAY,eAAe;AAAA,MACrC,CAAC;AAAA,IACH;AACA,QAAI,YAAY,iBAAiB;AAC/B,mBAAa,cAAc,UAAU,EAAE,GAAG,WAAW,OAAO,GAAG,YAAY,gBAAgB,CAAC;AAC5F,UAAI,CAAC,WAAW,GAAI,QAAO,aAAa,KAAK,WAAW,MAAM,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,IAC7F;AAEA,UAAM,aAAa,WAAW;AAE9B,UAAM,QAAQ,SAAS,0BAA0B,qBAAqB,YAAY,EAAE,SAAS,CAAC;AAC9F,UAAM,6BAA6B,oBAAoB,SAAS,GAAG,QAAQ;AAE3E,eAAW,YAAY,YAAY,uBAAuB;AACxD,UAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAI;AACF,cAAM,SAAS,MAAM,aAAa,EAAE,GAAG,YAAY,UAAU,SAAS,YAAY,KAAK,CAAC;AAAA,MAC1F,SAAS,eAAe;AACtB,eAAO,MAAM,+CAA+C;AAAA,UAC1D,WAAW;AAAA,UACX,SAAS,SAAS,MAAM;AAAA,UACxB,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,aAAa,KAAK,UAAU;AAAA,EACrC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY;AAEhE,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,QAAQ,gBAAgB;AAAA,EACjC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,QAAQ,SAAS;AAAA,EAC1B,OAAO,EAAE,QAAQ,iCAAiC;AAAA,EAClD,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,MAAM,CAAC,SAAS;AAAA,MAChB,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,oBAAoB,QAAQ,EAAE;AAAA,MACpH;AAAA,MACA,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY,CAAC;AAAA,IAC5E;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,SAAS;AAAA,MAChB,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB,CAAC;AAAA,MACrG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uCAAuC,QAAQ,oBAAoB;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,uBAAuB;AAAA,MAClI;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/catalog/api/prices/history/route.js

@@ -0,0 +1,131 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CatalogPriceHistoryEntry } from "../../../data/entities.js";
+import { priceHistoryQuerySchema } from "../../../data/validators.js";
+import { PRICE_HISTORY_CHANGE_TYPES, PRICE_HISTORY_SOURCES } from "../../../lib/omnibusTypes.js";
+import {
+  applyPriceHistoryCursor,
+  buildPriceHistoryWhere,
+  decodePriceHistoryCursor,
+  encodePriceHistoryCursor,
+  resolvePriceHistoryOrganizationIds,
+  serializePriceHistoryEntry
+} from "../../../lib/priceHistoryQuery.js";
+const logger = createLogger("catalog");
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["catalog.price_history.view"] }
+};
+async function GET(req) {
+  try {
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const url = new URL(req.url);
+    const parsed = priceHistoryQuerySchema.safeParse(Object.fromEntries(url.searchParams));
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "Invalid query", details: z.flattenError(parsed.error) },
+        { status: 400 }
+      );
+    }
+    const query = parsed.data;
+    const container = await createRequestContainer();
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope.tenantId ?? auth.tenantId;
+    const organizationIds = resolvePriceHistoryOrganizationIds(scope, auth.orgId);
+    if (organizationIds !== null && organizationIds.length === 0) {
+      return NextResponse.json({ items: [], nextCursor: null, ...query.includeTotal === "true" ? { total: 0 } : {} });
+    }
+    const em = container.resolve("em").fork();
+    const baseWhere = buildPriceHistoryWhere(
+      { tenantId, organizationIds },
+      query
+    );
+    const cursor = decodePriceHistoryCursor(query.cursor);
+    const rows = await findWithDecryption(
+      em,
+      CatalogPriceHistoryEntry,
+      applyPriceHistoryCursor(baseWhere, cursor),
+      { orderBy: { recordedAt: "desc", id: "desc" }, limit: query.pageSize + 1 },
+      { tenantId, organizationId: scope.selectedId ?? auth.orgId ?? null }
+    );
+    const hasMore = rows.length > query.pageSize;
+    const pageRows = hasMore ? rows.slice(0, query.pageSize) : rows;
+    const items = pageRows.map(serializePriceHistoryEntry);
+    const last = items[items.length - 1];
+    const nextCursor = hasMore && last ? encodePriceHistoryCursor({ recordedAt: last.recordedAt, id: last.id }) : null;
+    if (query.includeTotal === "true") {
+      const total = await em.count(CatalogPriceHistoryEntry, baseWhere);
+      return NextResponse.json({ items, nextCursor, total });
+    }
+    return NextResponse.json({ items, nextCursor });
+  } catch (err) {
+    logger.error("catalog.prices.history.GET Unexpected error", { err });
+    getTelemetryRuntime()?.reportError(err, {
+      module: "catalog",
+      code: "catalog.price_history_read_failed"
+    });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const priceHistoryItemSchema = z.object({
+  id: z.string().uuid(),
+  priceId: z.string().uuid(),
+  productId: z.string().uuid(),
+  variantId: z.string().uuid().nullable(),
+  offerId: z.string().uuid().nullable(),
+  channelId: z.string().uuid().nullable(),
+  priceKindId: z.string().uuid(),
+  priceKindCode: z.string(),
+  currencyCode: z.string(),
+  unitPriceNet: z.string().nullable(),
+  unitPriceGross: z.string().nullable(),
+  taxRate: z.string().nullable(),
+  taxAmount: z.string().nullable(),
+  minQuantity: z.number().int().nullable(),
+  maxQuantity: z.number().int().nullable(),
+  startsAt: z.string().nullable(),
+  endsAt: z.string().nullable(),
+  recordedAt: z.string(),
+  changeType: z.enum(PRICE_HISTORY_CHANGE_TYPES),
+  source: z.enum(PRICE_HISTORY_SOURCES),
+  isAnnounced: z.boolean()
+});
+const priceHistoryResponseSchema = z.object({
+  items: z.array(priceHistoryItemSchema),
+  nextCursor: z.string().nullable(),
+  total: z.number().int().optional()
+});
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "Catalog",
+  summary: "Catalog price history",
+  methods: {
+    GET: {
+      summary: "List recorded price history entries",
+      description: "Returns immutable price history snapshots for one product and/or variant, ordered by recordedAt DESC, id DESC with keyset pagination. At least one of productId or variantId is required (400 otherwise) so every read stays on a scoped index. Monetary values are fixed 4-decimal strings. An invalid cursor returns the first page.",
+      query: priceHistoryQuerySchema,
+      responses: [
+        { status: 200, description: "Price history page", schema: priceHistoryResponseSchema }
+      ],
+      errors: [
+        { status: 400, description: "Invalid query, or neither productId nor variantId provided", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Missing catalog.price_history.view", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/catalog/api/prices/history/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/catalog/api/prices/history/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CatalogPriceHistoryEntry } from '../../../data/entities'\nimport { priceHistoryQuerySchema } from '../../../data/validators'\nimport { PRICE_HISTORY_CHANGE_TYPES, PRICE_HISTORY_SOURCES } from '../../../lib/omnibusTypes'\nimport {\n  applyPriceHistoryCursor,\n  buildPriceHistoryWhere,\n  decodePriceHistoryCursor,\n  encodePriceHistoryCursor,\n  resolvePriceHistoryOrganizationIds,\n  serializePriceHistoryEntry,\n} from '../../../lib/priceHistoryQuery'\n\nconst logger = createLogger('catalog')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['catalog.price_history.view'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n\n    const url = new URL(req.url)\n    const parsed = priceHistoryQuerySchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!parsed.success) {\n      return NextResponse.json(\n        { error: 'Invalid query', details: z.flattenError(parsed.error) },\n        { status: 400 },\n      )\n    }\n    const query = parsed.data\n\n    const container = await createRequestContainer()\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope.tenantId ?? auth.tenantId\n    const organizationIds = resolvePriceHistoryOrganizationIds(scope, auth.orgId)\n    if (organizationIds !== null && organizationIds.length === 0) {\n      return NextResponse.json({ items: [], nextCursor: null, ...(query.includeTotal === 'true' ? { total: 0 } : {}) })\n    }\n\n    const em = (container.resolve('em') as EntityManager).fork()\n    const baseWhere = buildPriceHistoryWhere(\n      { tenantId, organizationIds },\n      query,\n    )\n    const cursor = decodePriceHistoryCursor(query.cursor)\n    const rows = await findWithDecryption(\n      em,\n      CatalogPriceHistoryEntry,\n      applyPriceHistoryCursor(baseWhere, cursor),\n      { orderBy: { recordedAt: 'desc', id: 'desc' }, limit: query.pageSize + 1 },\n      { tenantId, organizationId: scope.selectedId ?? auth.orgId ?? null },\n    )\n    const hasMore = rows.length > query.pageSize\n    const pageRows = hasMore ? rows.slice(0, query.pageSize) : rows\n    const items = pageRows.map(serializePriceHistoryEntry)\n    const last = items[items.length - 1]\n    const nextCursor = hasMore && last ? encodePriceHistoryCursor({ recordedAt: last.recordedAt, id: last.id }) : null\n\n    if (query.includeTotal === 'true') {\n      const total = await em.count(CatalogPriceHistoryEntry, baseWhere)\n      return NextResponse.json({ items, nextCursor, total })\n    }\n    return NextResponse.json({ items, nextCursor })\n  } catch (err) {\n    logger.error('catalog.prices.history.GET Unexpected error', { err })\n    getTelemetryRuntime()?.reportError(err, {\n      module: 'catalog',\n      code: 'catalog.price_history_read_failed',\n    })\n    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })\n  }\n}\n\nconst priceHistoryItemSchema = z.object({\n  id: z.string().uuid(),\n  priceId: z.string().uuid(),\n  productId: z.string().uuid(),\n  variantId: z.string().uuid().nullable(),\n  offerId: z.string().uuid().nullable(),\n  channelId: z.string().uuid().nullable(),\n  priceKindId: z.string().uuid(),\n  priceKindCode: z.string(),\n  currencyCode: z.string(),\n  unitPriceNet: z.string().nullable(),\n  unitPriceGross: z.string().nullable(),\n  taxRate: z.string().nullable(),\n  taxAmount: z.string().nullable(),\n  minQuantity: z.number().int().nullable(),\n  maxQuantity: z.number().int().nullable(),\n  startsAt: z.string().nullable(),\n  endsAt: z.string().nullable(),\n  recordedAt: z.string(),\n  changeType: z.enum(PRICE_HISTORY_CHANGE_TYPES),\n  source: z.enum(PRICE_HISTORY_SOURCES),\n  isAnnounced: z.boolean(),\n})\n\nconst priceHistoryResponseSchema = z.object({\n  items: z.array(priceHistoryItemSchema),\n  nextCursor: z.string().nullable(),\n  total: z.number().int().optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Catalog',\n  summary: 'Catalog price history',\n  methods: {\n    GET: {\n      summary: 'List recorded price history entries',\n      description:\n        'Returns immutable price history snapshots for one product and/or variant, ordered by recordedAt DESC, id DESC with keyset pagination. At least one of productId or variantId is required (400 otherwise) so every read stays on a scoped index. Monetary values are fixed 4-decimal strings. An invalid cursor returns the first page.',\n      query: priceHistoryQuerySchema,\n      responses: [\n        { status: 200, description: 'Price history page', schema: priceHistoryResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query, or neither productId nor variantId provided', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Missing catalog.price_history.view', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAEpC,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,+BAA+B;AACxC,SAAS,4BAA4B,6BAA6B;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,SAAS;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AAEA,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,SAAS,wBAAwB,UAAU,OAAO,YAAY,IAAI,YAAY,CAAC;AACrF,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,iBAAiB,SAAS,EAAE,aAAa,OAAO,KAAK,EAAE;AAAA,QAChE,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,QAAQ,OAAO;AAErB,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,MAAM,YAAY,KAAK;AACxC,UAAM,kBAAkB,mCAAmC,OAAO,KAAK,KAAK;AAC5E,QAAI,oBAAoB,QAAQ,gBAAgB,WAAW,GAAG;AAC5D,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,YAAY,MAAM,GAAI,MAAM,iBAAiB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAG,CAAC;AAAA,IAClH;AAEA,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,YAAY;AAAA,MAChB,EAAE,UAAU,gBAAgB;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,SAAS,yBAAyB,MAAM,MAAM;AACpD,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,wBAAwB,WAAW,MAAM;AAAA,MACzC,EAAE,SAAS,EAAE,YAAY,QAAQ,IAAI,OAAO,GAAG,OAAO,MAAM,WAAW,EAAE;AAAA,MACzE,EAAE,UAAU,gBAAgB,MAAM,cAAc,KAAK,SAAS,KAAK;AAAA,IACrE;AACA,UAAM,UAAU,KAAK,SAAS,MAAM;AACpC,UAAM,WAAW,UAAU,KAAK,MAAM,GAAG,MAAM,QAAQ,IAAI;AAC3D,UAAM,QAAQ,SAAS,IAAI,0BAA0B;AACrD,UAAM,OAAO,MAAM,MAAM,SAAS,CAAC;AACnC,UAAM,aAAa,WAAW,OAAO,yBAAyB,EAAE,YAAY,KAAK,YAAY,IAAI,KAAK,GAAG,CAAC,IAAI;AAE9G,QAAI,MAAM,iBAAiB,QAAQ;AACjC,YAAM,QAAQ,MAAM,GAAG,MAAM,0BAA0B,SAAS;AAChE,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,MAAM,CAAC;AAAA,IACvD;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,CAAC;AAAA,EAChD,SAAS,KAAK;AACZ,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,wBAAoB,GAAG,YAAY,KAAK;AAAA,MACtC,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,eAAe,EAAE,OAAO;AAAA,EACxB,cAAc,EAAE,OAAO;AAAA,EACvB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,KAAK,0BAA0B;AAAA,EAC7C,QAAQ,EAAE,KAAK,qBAAqB;AAAA,EACpC,aAAa,EAAE,QAAQ;AACzB,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,MAAM,sBAAsB;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACnC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE3C,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,2BAA2B;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,8DAA8D,QAAQ,YAAY;AAAA,QAC9G,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/catalog/api/prices/omnibus-preview/route.js

@@ -0,0 +1,184 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import {
+  CatalogOffer,
+  CatalogPriceKind,
+  CatalogProduct,
+  CatalogProductPrice,
+  CatalogProductVariant
+} from "../../../data/entities.js";
+import { omnibusPreviewQuerySchema } from "../../../data/validators.js";
+import { omnibusBlockSchema } from "../../../lib/omnibusTypes.js";
+import { resolveOmnibusPresentedEntries } from "../../../lib/omnibusPresentedEntry.js";
+import { resolvePriceHistoryOrganizationIds } from "../../../lib/priceHistoryQuery.js";
+import { resolvePriceVariantId, selectBestPrice } from "../../../lib/pricing.js";
+const logger = createLogger("catalog");
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["catalog.price_history.view"] }
+};
+const NOT_FOUND = { error: "Not found" };
+function relationId(value) {
+  if (!value) return null;
+  return typeof value === "string" ? value : value.id;
+}
+async function GET(req) {
+  try {
+    const auth = await getAuthFromRequest(req);
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+    const url = new URL(req.url);
+    const parsed = omnibusPreviewQuerySchema.safeParse(Object.fromEntries(url.searchParams));
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: "Invalid query", details: z.flattenError(parsed.error) },
+        { status: 400 }
+      );
+    }
+    const query = parsed.data;
+    const container = await createRequestContainer();
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+    const tenantId = scope.tenantId ?? auth.tenantId;
+    const organizationIds = resolvePriceHistoryOrganizationIds(scope, auth.orgId);
+    if (organizationIds !== null && organizationIds.length === 0) {
+      return NextResponse.json(NOT_FOUND, { status: 404 });
+    }
+    const organizationFilter = organizationIds === null ? {} : { organizationId: { $in: organizationIds } };
+    const decryptionScope = { tenantId, organizationId: scope.selectedId ?? auth.orgId ?? null };
+    const em = container.resolve("em").fork();
+    const offer = query.offerId ? await findOneWithDecryption(
+      em,
+      CatalogOffer,
+      { id: query.offerId, tenantId, deletedAt: null, ...organizationFilter },
+      void 0,
+      decryptionScope
+    ) : null;
+    if (query.offerId && !offer) return NextResponse.json(NOT_FOUND, { status: 404 });
+    const variant = query.variantId ? await findOneWithDecryption(
+      em,
+      CatalogProductVariant,
+      { id: query.variantId, tenantId, deletedAt: null, ...organizationFilter },
+      void 0,
+      decryptionScope
+    ) : null;
+    if (query.variantId && !variant) return NextResponse.json(NOT_FOUND, { status: 404 });
+    const productIds = new Set(
+      [query.productId ?? null, relationId(offer?.product), relationId(variant?.product)].filter(
+        (id) => typeof id === "string"
+      )
+    );
+    if (productIds.size !== 1) return NextResponse.json(NOT_FOUND, { status: 404 });
+    const [productId] = Array.from(productIds);
+    const product = await findOneWithDecryption(
+      em,
+      CatalogProduct,
+      { id: productId, tenantId, deletedAt: null, ...organizationFilter },
+      void 0,
+      decryptionScope
+    );
+    if (!product) return NextResponse.json(NOT_FOUND, { status: 404 });
+    const organizationId = product.organizationId;
+    const productScope = { tenantId, organizationId };
+    const priceKind = await findOneWithDecryption(
+      em,
+      CatalogPriceKind,
+      {
+        id: query.priceKindId,
+        tenantId,
+        deletedAt: null,
+        $or: [{ organizationId }, { organizationId: null }]
+      },
+      void 0,
+      productScope
+    );
+    if (!priceKind) return NextResponse.json(NOT_FOUND, { status: 404 });
+    const priceRows = await findWithDecryption(
+      em,
+      CatalogProductPrice,
+      {
+        tenantId,
+        organizationId,
+        priceKind: query.priceKindId,
+        currencyCode: query.currencyCode,
+        $or: [{ product: productId }, ...query.variantId ? [{ variant: query.variantId }] : []]
+      },
+      { populate: ["offer", "variant", "product", "priceKind"] },
+      productScope
+    );
+    const scopedRows = priceRows.filter((row) => {
+      const rowVariantId = resolvePriceVariantId(row);
+      return !query.variantId || !rowVariantId || rowVariantId === query.variantId;
+    });
+    const presentedPrice = selectBestPrice(scopedRows, {
+      channelId: query.channelId ?? null,
+      offerId: query.offerId ?? null,
+      priceKindId: query.priceKindId,
+      currencyCode: query.currencyCode,
+      quantity: 1,
+      date: /* @__PURE__ */ new Date()
+    });
+    const presentedEntries = presentedPrice ? await resolveOmnibusPresentedEntries(em, [presentedPrice]) : /* @__PURE__ */ new Map();
+    const service = container.resolve("catalogOmnibusService");
+    const block = await service.resolveOmnibusBlock(
+      em,
+      {
+        tenantId,
+        organizationId,
+        productId,
+        variantId: query.variantId ?? null,
+        offerId: query.offerId ?? null,
+        channelId: query.channelId ?? null,
+        priceKindId: query.priceKindId,
+        currencyCode: query.currencyCode,
+        isStorefront: false
+      },
+      presentedPrice ? presentedEntries.get(presentedPrice.id) ?? null : null,
+      priceKind.isPromotion === true
+    );
+    return NextResponse.json(block);
+  } catch (err) {
+    logger.error("catalog.prices.omnibus-preview.GET Unexpected error", { err });
+    getTelemetryRuntime()?.reportError(err, {
+      module: "catalog",
+      code: "catalog.omnibus_preview_failed"
+    });
+    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
+  }
+}
+const errorSchema = z.object({ error: z.string() });
+const openApi = {
+  tag: "Catalog",
+  summary: "Catalog Omnibus reference-price preview",
+  methods: {
+    GET: {
+      summary: "Preview the Omnibus reference-price block",
+      description: "Resolves the EU Omnibus reference-price block for one product, variant or offer and price kind, using the current active price of that kind as the presented entry. Returns null when Omnibus is disabled for the tenant. Monetary values are fixed 4-decimal strings.",
+      query: omnibusPreviewQuerySchema,
+      responses: [
+        {
+          status: 200,
+          description: "Omnibus block, or null when Omnibus is disabled",
+          schema: omnibusBlockSchema.nullable()
+        }
+      ],
+      errors: [
+        { status: 400, description: "Invalid query", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Missing catalog.price_history.view", schema: errorSchema },
+        { status: 404, description: "Product, variant, offer or price kind not found in scope", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map