@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/api/route.js

@@ -0,0 +1,322 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
+import { documentCreateSchema, documentEntityTypeSchema } from "../data/validators.js";
+import { DOCUMENTS_ENTITY_IDS } from "../lib/constants.js";
+import { resolveUserLabels } from "../lib/userLabels.js";
+import { deriveDocumentCapabilities } from "../lib/capabilities.js";
+import { getVisibleDocumentPage } from "../lib/visibility.js";
+import { loadDocumentShareCounts } from "../lib/shareCounts.js";
+import { loadDocumentFavoriteIds } from "../lib/favorites.js";
+import { getEntityRegistryEntry } from "../lib/entityRegistry.js";
+import { verifyEntityRegistryTargetAccess } from "../lib/entityRegistry.server.js";
+import { isDocumentEntityRegistryModuleEnabled } from "../lib/entityRegistryAvailability.server.js";
+import {
+  handleDocumentsRouteError,
+  hasDocumentsFeature,
+  readBody,
+  resolveActorUserId,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  runMutationGuardAfterSuccess,
+  validateMutationGuard,
+  withDocumentsContextErrors
+} from "./_shared.js";
+import {
+  attachDocumentsOperationMetadata,
+  buildDocumentsCommandRuntimeContext,
+  resolveDocumentsCommandBus
+} from "./_commands.js";
+const listQuerySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(100).default(50),
+  search: z.string().trim().optional(),
+  id: z.string().uuid().optional(),
+  archived: z.enum(["exclude", "include", "only"]).default("exclude"),
+  favorite: z.string().optional().transform((value) => parseBooleanWithDefault(value, false)),
+  folderId: z.string().uuid().optional().nullable(),
+  entityType: documentEntityTypeSchema.optional(),
+  entityId: z.string().uuid().optional()
+}).superRefine((query, context) => {
+  if (Boolean(query.entityType) !== Boolean(query.entityId)) {
+    context.addIssue({
+      code: "custom",
+      message: "documents.validation.links.entityFilterPairRequired"
+    });
+  }
+});
+const capabilitiesSchema = z.object({
+  canView: z.boolean(),
+  canComment: z.boolean(),
+  canEdit: z.boolean(),
+  canShare: z.boolean(),
+  canDelete: z.boolean(),
+  canCreate: z.boolean(),
+  canManageTemplates: z.boolean(),
+  canArchive: z.boolean(),
+  canDuplicate: z.boolean()
+});
+const collectionCapabilitiesSchema = z.object({
+  canCreateDocument: z.boolean(),
+  canCreateFolder: z.boolean(),
+  canLinkDocuments: z.boolean(),
+  canInstantiateTemplate: z.boolean(),
+  canManageTemplates: z.boolean()
+});
+const documentListItemSchema = z.object({
+  id: z.string().uuid(),
+  title: z.string(),
+  folderId: z.string().uuid().nullable(),
+  ownerUserId: z.string().uuid(),
+  ownerLabel: z.string().nullable(),
+  createdByUserId: z.string().uuid(),
+  isActive: z.boolean(),
+  archivedAt: z.string().nullable(),
+  isFavorite: z.boolean(),
+  sharedWithCount: z.number(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  relationshipTier: z.enum(["owner", "editor", "commenter", "viewer"]).nullable(),
+  capabilities: capabilitiesSchema
+});
+const listResponseSchema = z.object({
+  items: z.array(documentListItemSchema),
+  collectionCapabilities: collectionCapabilitiesSchema,
+  total: z.number(),
+  page: z.number(),
+  pageSize: z.number(),
+  totalPages: z.number()
+});
+const createResponseSchema = z.object({
+  id: z.string().uuid(),
+  updatedAt: z.string()
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.view"] },
+  POST: { requireAuth: true, requireFeatures: ["documents.create"] }
+};
+function readString(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+function readBoolean(record, ...keys) {
+  for (const key of keys) {
+    if (typeof record[key] === "boolean") return record[key];
+  }
+  return false;
+}
+function readDate(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    const date = value instanceof Date ? value : typeof value === "string" && value.length > 0 ? new Date(value) : null;
+    if (date && !Number.isNaN(date.getTime())) return date.toISOString();
+  }
+  return (/* @__PURE__ */ new Date(0)).toISOString();
+}
+function readNullableDate(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (value === null || value === void 0) continue;
+    const date = value instanceof Date ? value : typeof value === "string" && value.length > 0 ? new Date(value) : null;
+    if (date && !Number.isNaN(date.getTime())) return date.toISOString();
+  }
+  return null;
+}
+async function GET(request) {
+  try {
+    const ctx = await resolveDocumentsContext(request, ["documents.view"]);
+    const url = new URL(request.url);
+    const query = listQuerySchema.parse(Object.fromEntries(url.searchParams.entries()));
+    let relationFilter = null;
+    if (query.entityType && query.entityId) {
+      const registryEntry = getEntityRegistryEntry(query.entityType);
+      if (!registryEntry || !isDocumentEntityRegistryModuleEnabled(registryEntry) || !hasDocumentsFeature(ctx.auth, registryEntry.requiredFeature)) {
+        throw new CrudHttpError(403, { error: "api.errors.forbidden" });
+      }
+      const verifiedTarget = await verifyEntityRegistryTargetAccess(request, {
+        entityType: query.entityType,
+        entityId: query.entityId
+      });
+      relationFilter = {
+        entityType: query.entityType,
+        entityId: verifiedTarget.id
+      };
+    }
+    const actorUserId = resolveActorUserId(ctx.auth);
+    const managerOverride = hasDocumentsFeature(ctx.auth, "documents.manage");
+    const visiblePage = await getVisibleDocumentPage({
+      em: ctx.em,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      userId: actorUserId,
+      roleIds: ctx.auth.roleIds,
+      managerOverride,
+      page: query.page,
+      pageSize: query.pageSize,
+      id: query.id ?? null,
+      archived: query.archived,
+      favoriteUserId: query.favorite ? actorUserId : null,
+      search: query.search ?? null,
+      folderId: query.folderId ?? null,
+      relationFilter
+    });
+    const orderedIds = visiblePage.rows.map((row) => row.id);
+    const queryEngine = ctx.container.resolve("queryEngine");
+    const hydration = orderedIds.length > 0 ? await queryEngine.query(DOCUMENTS_ENTITY_IDS.document, {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      filters: { id: { $in: orderedIds } },
+      page: { page: 1, pageSize: orderedIds.length },
+      extensions: {
+        userId: actorUserId,
+        container: ctx.container,
+        userFeatures: ctx.auth.features,
+        resolve: (name) => ctx.container.resolve(name)
+      }
+    }) : { items: [] };
+    const hydratedById = new Map(
+      hydration.items.map((item) => [readString(item, "id"), item]).filter((entry) => entry[0] !== null)
+    );
+    const pageDocuments = orderedIds.map((id) => hydratedById.get(id) ?? null).filter((item) => item !== null);
+    const ownerLabels = await resolveUserLabels(
+      ctx.container,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+      pageDocuments.map((document) => readString(document, "ownerUserId", "owner_user_id")).filter((id) => id !== null)
+    );
+    const shareCounts = await loadDocumentShareCounts(
+      ctx.em,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+      orderedIds
+    );
+    const favoriteDocumentIds = await loadDocumentFavoriteIds(
+      ctx.em,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId, userId: actorUserId },
+      orderedIds
+    );
+    const visibleRowsById = new Map(visiblePage.rows.map((row) => [row.id, row]));
+    const items = pageDocuments.map((document) => {
+      const id = readString(document, "id") ?? "";
+      const ownerUserId = readString(document, "ownerUserId", "owner_user_id") ?? "";
+      const visibleRow = visibleRowsById.get(id);
+      const relationshipTier = visibleRow?.relationshipTier ?? null;
+      const archivedAt = readNullableDate(document, "archivedAt", "archived_at");
+      return {
+        id,
+        title: readString(document, "title") ?? "",
+        folderId: readString(document, "folderId", "folder_id"),
+        ownerUserId,
+        ownerLabel: ownerLabels.get(ownerUserId)?.label ?? null,
+        createdByUserId: readString(document, "createdByUserId", "created_by_user_id") ?? "",
+        isActive: readBoolean(document, "isActive", "is_active"),
+        archivedAt,
+        isFavorite: favoriteDocumentIds.has(id),
+        sharedWithCount: shareCounts.get(id) ?? 0,
+        createdAt: readDate(document, "createdAt", "created_at"),
+        updatedAt: readDate(document, "updatedAt", "updated_at"),
+        relationshipTier,
+        capabilities: deriveDocumentCapabilities({
+          relationshipTier,
+          managerOverride,
+          archived: archivedAt !== null,
+          userFeatures: ctx.auth.features
+        })
+      };
+    });
+    return NextResponse.json({
+      items,
+      collectionCapabilities: {
+        canCreateDocument: hasDocumentsFeature(ctx.auth, "documents.create"),
+        canCreateFolder: hasDocumentsFeature(ctx.auth, "documents.edit"),
+        canLinkDocuments: hasDocumentsFeature(ctx.auth, "documents.edit"),
+        canInstantiateTemplate: hasDocumentsFeature(ctx.auth, "documents.create") && hasDocumentsFeature(ctx.auth, "documents.edit"),
+        canManageTemplates: hasDocumentsFeature(ctx.auth, "documents.templates.manage")
+      },
+      total: visiblePage.total,
+      page: query.page,
+      pageSize: query.pageSize,
+      totalPages: Math.max(1, Math.ceil(visiblePage.total / query.pageSize))
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.list");
+  }
+}
+async function POST(request) {
+  try {
+    const ctx = await resolveDocumentsContext(request, ["documents.create"]);
+    const body = await readBody(request);
+    const input = documentCreateSchema.parse(body);
+    const guardResult = await validateMutationGuard(ctx, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: "new",
+      operation: "create",
+      mutationPayload: input,
+      mutationPayloadSchema: documentCreateSchema
+    });
+    const commandInput = {
+      ...input,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId,
+      documentId: randomUUID(),
+      contentId: randomUUID()
+    };
+    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute("documents.document.create", {
+      input: commandInput,
+      ctx: buildDocumentsCommandRuntimeContext(ctx)
+    });
+    await runMutationGuardAfterSuccess(ctx, guardResult, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: "new",
+      operation: "create"
+    });
+    const response = NextResponse.json(
+      { id: result.id, updatedAt: result.updatedAt },
+      { status: 201 }
+    );
+    return attachDocumentsOperationMetadata(response, logEntry, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: result.id
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.create");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document collection",
+  methods: {
+    GET: {
+      summary: "List visible documents",
+      query: listQuerySchema,
+      responses: [{ status: 200, description: "Visible document metadata", schema: listResponseSchema }],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema }
+      ]
+    },
+    POST: {
+      summary: "Create document",
+      requestBody: { contentType: "application/json", schema: documentCreateSchema },
+      responses: [{ status: 201, description: "Document created", schema: createResponseSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 413, description: "Request body exceeds the safe resource bound", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET, POST };
+export {
+  GET,
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/documents/api/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { randomUUID } from 'node:crypto'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { documentCreateSchema, documentEntityTypeSchema } from '../data/validators'\nimport { DOCUMENTS_ENTITY_IDS } from '../lib/constants'\nimport { resolveUserLabels } from '../lib/userLabels'\nimport { deriveDocumentCapabilities } from '../lib/capabilities'\nimport { getVisibleDocumentPage } from '../lib/visibility'\nimport { loadDocumentShareCounts } from '../lib/shareCounts'\nimport { loadDocumentFavoriteIds } from '../lib/favorites'\nimport { getEntityRegistryEntry } from '../lib/entityRegistry'\nimport { verifyEntityRegistryTargetAccess } from '../lib/entityRegistry.server'\nimport { isDocumentEntityRegistryModuleEnabled } from '../lib/entityRegistryAvailability.server'\nimport {\n  handleDocumentsRouteError,\n  hasDocumentsFeature,\n  readBody,\n  resolveActorUserId,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  runMutationGuardAfterSuccess,\n  validateMutationGuard,\n  withDocumentsContextErrors,\n} from './_shared'\nimport {\n  attachDocumentsOperationMetadata,\n  buildDocumentsCommandRuntimeContext,\n  resolveDocumentsCommandBus,\n} from './_commands'\nimport type { DocumentCreateCommandInput } from '../commands/document-crud'\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(50),\n  search: z.string().trim().optional(),\n  id: z.string().uuid().optional(),\n  archived: z.enum(['exclude', 'include', 'only']).default('exclude'),\n  favorite: z.string().optional().transform((value) => parseBooleanWithDefault(value, false)),\n  folderId: z.string().uuid().optional().nullable(),\n  entityType: documentEntityTypeSchema.optional(),\n  entityId: z.string().uuid().optional(),\n}).superRefine((query, context) => {\n  if (Boolean(query.entityType) !== Boolean(query.entityId)) {\n    context.addIssue({\n      code: 'custom',\n      message: 'documents.validation.links.entityFilterPairRequired',\n    })\n  }\n})\n\nconst capabilitiesSchema = z.object({\n  canView: z.boolean(),\n  canComment: z.boolean(),\n  canEdit: z.boolean(),\n  canShare: z.boolean(),\n  canDelete: z.boolean(),\n  canCreate: z.boolean(),\n  canManageTemplates: z.boolean(),\n  canArchive: z.boolean(),\n  canDuplicate: z.boolean(),\n})\n\nconst collectionCapabilitiesSchema = z.object({\n  canCreateDocument: z.boolean(),\n  canCreateFolder: z.boolean(),\n  canLinkDocuments: z.boolean(),\n  canInstantiateTemplate: z.boolean(),\n  canManageTemplates: z.boolean(),\n})\n\nconst documentListItemSchema = z.object({\n  id: z.string().uuid(),\n  title: z.string(),\n  folderId: z.string().uuid().nullable(),\n  ownerUserId: z.string().uuid(),\n  ownerLabel: z.string().nullable(),\n  createdByUserId: z.string().uuid(),\n  isActive: z.boolean(),\n  archivedAt: z.string().nullable(),\n  isFavorite: z.boolean(),\n  sharedWithCount: z.number(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n  relationshipTier: z.enum(['owner', 'editor', 'commenter', 'viewer']).nullable(),\n  capabilities: capabilitiesSchema,\n})\n\nconst listResponseSchema = z.object({\n  items: z.array(documentListItemSchema),\n  collectionCapabilities: collectionCapabilitiesSchema,\n  total: z.number(),\n  page: z.number(),\n  pageSize: z.number(),\n  totalPages: z.number(),\n})\n\nconst createResponseSchema = z.object({\n  id: z.string().uuid(),\n  updatedAt: z.string(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['documents.view'] },\n  POST: { requireAuth: true, requireFeatures: ['documents.create'] },\n}\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n  return null\n}\n\nfunction readBoolean(record: Record<string, unknown>, ...keys: string[]): boolean {\n  for (const key of keys) {\n    if (typeof record[key] === 'boolean') return record[key] as boolean\n  }\n  return false\n}\n\nfunction readDate(record: Record<string, unknown>, ...keys: string[]): string {\n  for (const key of keys) {\n    const value = record[key]\n    const date = value instanceof Date\n      ? value\n      : typeof value === 'string' && value.length > 0\n        ? new Date(value)\n        : null\n    if (date && !Number.isNaN(date.getTime())) return date.toISOString()\n  }\n  return new Date(0).toISOString()\n}\n\nfunction readNullableDate(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (value === null || value === undefined) continue\n    const date = value instanceof Date\n      ? value\n      : typeof value === 'string' && value.length > 0\n        ? new Date(value)\n        : null\n    if (date && !Number.isNaN(date.getTime())) return date.toISOString()\n  }\n  return null\n}\n\nexport async function GET(request: Request): Promise<Response> {\n  try {\n    const ctx = await resolveDocumentsContext(request, ['documents.view'])\n    const url = new URL(request.url)\n    const query = listQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))\n\n    let relationFilter: { entityType: z.infer<typeof documentEntityTypeSchema>; entityId: string } | null = null\n    if (query.entityType && query.entityId) {\n      const registryEntry = getEntityRegistryEntry(query.entityType)\n      if (\n        !registryEntry\n        || !isDocumentEntityRegistryModuleEnabled(registryEntry)\n        || !hasDocumentsFeature(ctx.auth, registryEntry.requiredFeature)\n      ) {\n        throw new CrudHttpError(403, { error: 'api.errors.forbidden' })\n      }\n      const verifiedTarget = await verifyEntityRegistryTargetAccess(request, {\n        entityType: query.entityType,\n        entityId: query.entityId,\n      })\n      relationFilter = {\n        entityType: query.entityType,\n        entityId: verifiedTarget.id,\n      }\n    }\n\n    const actorUserId = resolveActorUserId(ctx.auth)\n    const managerOverride = hasDocumentsFeature(ctx.auth, 'documents.manage')\n    const visiblePage = await getVisibleDocumentPage({\n      em: ctx.em,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: actorUserId,\n      roleIds: ctx.auth.roleIds,\n      managerOverride,\n      page: query.page,\n      pageSize: query.pageSize,\n      id: query.id ?? null,\n      archived: query.archived,\n      favoriteUserId: query.favorite ? actorUserId : null,\n      search: query.search ?? null,\n      folderId: query.folderId ?? null,\n      relationFilter,\n    })\n    const orderedIds = visiblePage.rows.map((row) => row.id)\n    const queryEngine = ctx.container.resolve('queryEngine') as QueryEngine\n    const hydration = orderedIds.length > 0\n      ? await queryEngine.query<Record<string, unknown>>(DOCUMENTS_ENTITY_IDS.document, {\n          tenantId: ctx.tenantId,\n          organizationId: ctx.organizationId,\n          filters: { id: { $in: orderedIds } },\n          page: { page: 1, pageSize: orderedIds.length },\n          extensions: {\n            userId: actorUserId,\n            container: ctx.container,\n            userFeatures: ctx.auth.features,\n            resolve: <T = unknown>(name: string) => ctx.container.resolve(name) as T,\n          },\n        })\n      : { items: [] as Record<string, unknown>[] }\n    const hydratedById = new Map(\n      hydration.items\n        .map((item) => [readString(item, 'id'), item] as const)\n        .filter((entry): entry is readonly [string, Record<string, unknown>] => entry[0] !== null),\n    )\n    const pageDocuments = orderedIds\n      .map((id) => hydratedById.get(id) ?? null)\n      .filter((item): item is Record<string, unknown> => item !== null)\n    const ownerLabels = await resolveUserLabels(\n      ctx.container,\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n      pageDocuments\n        .map((document) => readString(document, 'ownerUserId', 'owner_user_id'))\n        .filter((id): id is string => id !== null),\n    )\n    const shareCounts = await loadDocumentShareCounts(\n      ctx.em,\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n      orderedIds,\n    )\n    const favoriteDocumentIds = await loadDocumentFavoriteIds(\n      ctx.em,\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId, userId: actorUserId },\n      orderedIds,\n    )\n    const visibleRowsById = new Map(visiblePage.rows.map((row) => [row.id, row]))\n    const items = pageDocuments.map((document) => {\n      const id = readString(document, 'id') ?? ''\n      const ownerUserId = readString(document, 'ownerUserId', 'owner_user_id') ?? ''\n      const visibleRow = visibleRowsById.get(id)\n      const relationshipTier = visibleRow?.relationshipTier ?? null\n      const archivedAt = readNullableDate(document, 'archivedAt', 'archived_at')\n      return {\n        id,\n        title: readString(document, 'title') ?? '',\n        folderId: readString(document, 'folderId', 'folder_id'),\n        ownerUserId,\n        ownerLabel: ownerLabels.get(ownerUserId)?.label ?? null,\n        createdByUserId: readString(document, 'createdByUserId', 'created_by_user_id') ?? '',\n        isActive: readBoolean(document, 'isActive', 'is_active'),\n        archivedAt,\n        isFavorite: favoriteDocumentIds.has(id),\n        sharedWithCount: shareCounts.get(id) ?? 0,\n        createdAt: readDate(document, 'createdAt', 'created_at'),\n        updatedAt: readDate(document, 'updatedAt', 'updated_at'),\n        relationshipTier,\n        capabilities: deriveDocumentCapabilities({\n          relationshipTier,\n          managerOverride,\n          archived: archivedAt !== null,\n          userFeatures: ctx.auth.features,\n        }),\n      }\n    })\n\n    return NextResponse.json({\n      items,\n      collectionCapabilities: {\n        canCreateDocument: hasDocumentsFeature(ctx.auth, 'documents.create'),\n        canCreateFolder: hasDocumentsFeature(ctx.auth, 'documents.edit'),\n        canLinkDocuments: hasDocumentsFeature(ctx.auth, 'documents.edit'),\n        canInstantiateTemplate:\n          hasDocumentsFeature(ctx.auth, 'documents.create')\n          && hasDocumentsFeature(ctx.auth, 'documents.edit'),\n        canManageTemplates: hasDocumentsFeature(ctx.auth, 'documents.templates.manage'),\n      },\n      total: visiblePage.total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: Math.max(1, Math.ceil(visiblePage.total / query.pageSize)),\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.list')\n  }\n}\n\nexport async function POST(request: Request): Promise<Response> {\n  try {\n    const ctx = await resolveDocumentsContext(request, ['documents.create'])\n    const body = await readBody(request)\n    const input = documentCreateSchema.parse(body)\n    const guardResult = await validateMutationGuard(ctx, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: 'new',\n      operation: 'create',\n      mutationPayload: input,\n      mutationPayloadSchema: documentCreateSchema,\n    })\n\n    const commandInput: DocumentCreateCommandInput = {\n      ...input,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      documentId: randomUUID(),\n      contentId: randomUUID(),\n    }\n    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute<\n      DocumentCreateCommandInput,\n      { id: string; updatedAt: string }\n    >('documents.document.create', {\n      input: commandInput,\n      ctx: buildDocumentsCommandRuntimeContext(ctx),\n    })\n    await runMutationGuardAfterSuccess(ctx, guardResult, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: 'new',\n      operation: 'create',\n    })\n\n    const response = NextResponse.json(\n      { id: result.id, updatedAt: result.updatedAt },\n      { status: 201 },\n    )\n    return attachDocumentsOperationMetadata(response, logEntry, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: result.id,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.create')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document collection',\n  methods: {\n    GET: {\n      summary: 'List visible documents',\n      query: listQuerySchema,\n      responses: [{ status: 200, description: 'Visible document metadata', schema: listResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create document',\n      requestBody: { contentType: 'application/json', schema: documentCreateSchema },\n      responses: [{ status: 201, description: 'Document created', schema: createResponseSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 413, description: 'Request body exceeds the safe resource bound', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { GET, POST }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,kBAAkB;AAG3B,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,4BAA4B;AACrC,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B;AACxC,SAAS,8BAA8B;AACvC,SAAS,wCAAwC;AACjD,SAAS,6CAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC5D,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,KAAK,CAAC,WAAW,WAAW,MAAM,CAAC,EAAE,QAAQ,SAAS;AAAA,EAClE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,wBAAwB,OAAO,KAAK,CAAC;AAAA,EAC1F,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,YAAY,yBAAyB,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAI,QAAQ,MAAM,UAAU,MAAM,QAAQ,MAAM,QAAQ,GAAG;AACzD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,EAAE,QAAQ;AAAA,EACtB,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,WAAW,EAAE,QAAQ;AAAA,EACrB,WAAW,EAAE,QAAQ;AAAA,EACrB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,QAAQ;AAAA,EACtB,cAAc,EAAE,QAAQ;AAC1B,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,mBAAmB,EAAE,QAAQ;AAAA,EAC7B,iBAAiB,EAAE,QAAQ;AAAA,EAC3B,kBAAkB,EAAE,QAAQ;AAAA,EAC5B,wBAAwB,EAAE,QAAQ;AAAA,EAClC,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,UAAU,EAAE,QAAQ;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,kBAAkB,EAAE,KAAK,CAAC,SAAS,UAAU,aAAa,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC9E,cAAc;AAChB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,OAAO,EAAE,MAAM,sBAAsB;AAAA,EACrC,wBAAwB;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO;AAAA,EACnB,YAAY,EAAE,OAAO;AACvB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,YAAY,WAAoC,MAAyB;AAChF,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,OAAO,GAAG,MAAM,UAAW,QAAO,OAAO,GAAG;AAAA,EACzD;AACA,SAAO;AACT;AAEA,SAAS,SAAS,WAAoC,MAAwB;AAC5E,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,UAAM,OAAO,iBAAiB,OAC1B,QACA,OAAO,UAAU,YAAY,MAAM,SAAS,IAC1C,IAAI,KAAK,KAAK,IACd;AACN,QAAI,QAAQ,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO,KAAK,YAAY;AAAA,EACrE;AACA,UAAO,oBAAI,KAAK,CAAC,GAAE,YAAY;AACjC;AAEA,SAAS,iBAAiB,WAAoC,MAA+B;AAC3F,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,UAAM,OAAO,iBAAiB,OAC1B,QACA,OAAO,UAAU,YAAY,MAAM,SAAS,IAC1C,IAAI,KAAK,KAAK,IACd;AACN,QAAI,QAAQ,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,QAAO,KAAK,YAAY;AAAA,EACrE;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,SAAqC;AAC7D,MAAI;AACF,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AACrE,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,gBAAgB,MAAM,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AAElF,QAAI,iBAAoG;AACxG,QAAI,MAAM,cAAc,MAAM,UAAU;AACtC,YAAM,gBAAgB,uBAAuB,MAAM,UAAU;AAC7D,UACE,CAAC,iBACE,CAAC,sCAAsC,aAAa,KACpD,CAAC,oBAAoB,IAAI,MAAM,cAAc,eAAe,GAC/D;AACA,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AACA,YAAM,iBAAiB,MAAM,iCAAiC,SAAS;AAAA,QACrE,YAAY,MAAM;AAAA,QAClB,UAAU,MAAM;AAAA,MAClB,CAAC;AACD,uBAAiB;AAAA,QACf,YAAY,MAAM;AAAA,QAClB,UAAU,eAAe;AAAA,MAC3B;AAAA,IACF;AAEA,UAAM,cAAc,mBAAmB,IAAI,IAAI;AAC/C,UAAM,kBAAkB,oBAAoB,IAAI,MAAM,kBAAkB;AACxE,UAAM,cAAc,MAAM,uBAAuB;AAAA,MAC/C,IAAI,IAAI;AAAA,MACR,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ;AAAA,MACR,SAAS,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,IAAI,MAAM,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM,WAAW,cAAc;AAAA,MAC/C,QAAQ,MAAM,UAAU;AAAA,MACxB,UAAU,MAAM,YAAY;AAAA,MAC5B;AAAA,IACF,CAAC;AACD,UAAM,aAAa,YAAY,KAAK,IAAI,CAAC,QAAQ,IAAI,EAAE;AACvD,UAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,UAAM,YAAY,WAAW,SAAS,IAClC,MAAM,YAAY,MAA+B,qBAAqB,UAAU;AAAA,MAC9E,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,SAAS,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE;AAAA,MACnC,MAAM,EAAE,MAAM,GAAG,UAAU,WAAW,OAAO;AAAA,MAC7C,YAAY;AAAA,QACV,QAAQ;AAAA,QACR,WAAW,IAAI;AAAA,QACf,cAAc,IAAI,KAAK;AAAA,QACvB,SAAS,CAAc,SAAiB,IAAI,UAAU,QAAQ,IAAI;AAAA,MACpE;AAAA,IACF,CAAC,IACD,EAAE,OAAO,CAAC,EAA+B;AAC7C,UAAM,eAAe,IAAI;AAAA,MACvB,UAAU,MACP,IAAI,CAAC,SAAS,CAAC,WAAW,MAAM,IAAI,GAAG,IAAI,CAAU,EACrD,OAAO,CAAC,UAA+D,MAAM,CAAC,MAAM,IAAI;AAAA,IAC7F;AACA,UAAM,gBAAgB,WACnB,IAAI,CAAC,OAAO,aAAa,IAAI,EAAE,KAAK,IAAI,EACxC,OAAO,CAAC,SAA0C,SAAS,IAAI;AAClE,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MAC7D,cACG,IAAI,CAAC,aAAa,WAAW,UAAU,eAAe,eAAe,CAAC,EACtE,OAAO,CAAC,OAAqB,OAAO,IAAI;AAAA,IAC7C;AACA,UAAM,cAAc,MAAM;AAAA,MACxB,IAAI;AAAA,MACJ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MAC7D;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM;AAAA,MAChC,IAAI;AAAA,MACJ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,gBAAgB,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AACA,UAAM,kBAAkB,IAAI,IAAI,YAAY,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AAC5E,UAAM,QAAQ,cAAc,IAAI,CAAC,aAAa;AAC5C,YAAM,KAAK,WAAW,UAAU,IAAI,KAAK;AACzC,YAAM,cAAc,WAAW,UAAU,eAAe,eAAe,KAAK;AAC5E,YAAM,aAAa,gBAAgB,IAAI,EAAE;AACzC,YAAM,mBAAmB,YAAY,oBAAoB;AACzD,YAAM,aAAa,iBAAiB,UAAU,cAAc,aAAa;AACzE,aAAO;AAAA,QACL;AAAA,QACA,OAAO,WAAW,UAAU,OAAO,KAAK;AAAA,QACxC,UAAU,WAAW,UAAU,YAAY,WAAW;AAAA,QACtD;AAAA,QACA,YAAY,YAAY,IAAI,WAAW,GAAG,SAAS;AAAA,QACnD,iBAAiB,WAAW,UAAU,mBAAmB,oBAAoB,KAAK;AAAA,QAClF,UAAU,YAAY,UAAU,YAAY,WAAW;AAAA,QACvD;AAAA,QACA,YAAY,oBAAoB,IAAI,EAAE;AAAA,QACtC,iBAAiB,YAAY,IAAI,EAAE,KAAK;AAAA,QACxC,WAAW,SAAS,UAAU,aAAa,YAAY;AAAA,QACvD,WAAW,SAAS,UAAU,aAAa,YAAY;AAAA,QACvD;AAAA,QACA,cAAc,2BAA2B;AAAA,UACvC;AAAA,UACA;AAAA,UACA,UAAU,eAAe;AAAA,UACzB,cAAc,IAAI,KAAK;AAAA,QACzB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB;AAAA,MACA,wBAAwB;AAAA,QACtB,mBAAmB,oBAAoB,IAAI,MAAM,kBAAkB;AAAA,QACnE,iBAAiB,oBAAoB,IAAI,MAAM,gBAAgB;AAAA,QAC/D,kBAAkB,oBAAoB,IAAI,MAAM,gBAAgB;AAAA,QAChE,wBACE,oBAAoB,IAAI,MAAM,kBAAkB,KAC7C,oBAAoB,IAAI,MAAM,gBAAgB;AAAA,QACnD,oBAAoB,oBAAoB,IAAI,MAAM,4BAA4B;AAAA,MAChF;AAAA,MACA,OAAO,YAAY;AAAA,MACnB,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,YAAY,QAAQ,MAAM,QAAQ,CAAC;AAAA,IACvE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,gBAAgB;AAAA,EAC1D;AACF;AAEA,eAAsB,KAAK,SAAqC;AAC9D,MAAI;AACF,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,kBAAkB,CAAC;AACvE,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,UAAM,QAAQ,qBAAqB,MAAM,IAAI;AAC7C,UAAM,cAAc,MAAM,sBAAsB,KAAK;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,uBAAuB;AAAA,IACzB,CAAC;AAED,UAAM,eAA2C;AAAA,MAC/C,GAAG;AAAA,MACH,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,YAAY,WAAW;AAAA,MACvB,WAAW,WAAW;AAAA,IACxB;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,2BAA2B,GAAG,EAAE,QAGjE,6BAA6B;AAAA,MAC7B,OAAO;AAAA,MACP,KAAK,oCAAoC,GAAG;AAAA,IAC9C,CAAC;AACD,UAAM,6BAA6B,KAAK,aAAa;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,aAAa;AAAA,MAC5B,EAAE,IAAI,OAAO,IAAI,WAAW,OAAO,UAAU;AAAA,MAC7C,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,WAAO,iCAAiC,UAAU,UAAU;AAAA,MAC1D,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,kBAAkB;AAAA,EAC5D;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,mBAAmB,CAAC;AAAA,MACjG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,MACpE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,qBAAqB;AAAA,MAC7E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,qBAAqB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,iBAAiB;AAAA,MACvG;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK,KAAK;",
+  "names": []
+}

package/dist/modules/documents/api/templates/[templateId]/preview/route.js

@@ -0,0 +1,94 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { DocumentTemplate } from "../../../../data/entities.js";
+import { documentTemplatePreviewSchema } from "../../../../data/validators.js";
+import { prepareTemplateRender } from "../../../../lib/templateInstantiation.js";
+import { DOCUMENTS_JSON_BODY_LIMITS } from "../../../../lib/requestBody.js";
+import {
+  handleDocumentsRouteError,
+  readBody,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../../_shared.js";
+const previewResponseSchema = z.object({
+  contentHtml: z.string(),
+  unresolvedTokens: z.array(z.string()),
+  templateUpdatedAt: z.string(),
+  previewDigest: z.string()
+});
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["documents.create"] }
+};
+async function POST(request, context) {
+  try {
+    const templateId = (await context.params).templateId;
+    const ctx = await resolveDocumentsContext(request, ["documents.create"]);
+    const input = documentTemplatePreviewSchema.parse(await readBody(
+      request,
+      DOCUMENTS_JSON_BODY_LIMITS.templateRender
+    ));
+    const template = await findOneWithDecryption(
+      ctx.em,
+      DocumentTemplate,
+      {
+        id: templateId,
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        deletedAt: null,
+        isActive: true
+      },
+      void 0,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+    );
+    if (!template) throw new CrudHttpError(404, { error: "documents.templates.notFound" });
+    const prepared = await prepareTemplateRender({
+      request,
+      template,
+      title: input.title,
+      locale: input.locale,
+      effectiveDate: input.effectiveDate,
+      templateUpdatedAt: input.templateUpdatedAt,
+      slots: input.slots,
+      userFeatures: ctx.auth.features
+    });
+    return NextResponse.json({
+      contentHtml: prepared.render.html,
+      unresolvedTokens: prepared.render.unresolvedTokens,
+      templateUpdatedAt: template.updatedAt.toISOString(),
+      previewDigest: prepared.previewDigest
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.templates.preview");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Preview a contextual document template",
+  pathParams: z.object({ templateId: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Render a template preview without writing data",
+      requestBody: { contentType: "application/json", schema: documentTemplatePreviewSchema },
+      responses: [{ status: 200, description: "Rendered template preview", schema: previewResponseSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Template not found", schema: routeErrorSchema },
+        { status: 409, description: "Template revision changed", schema: routeErrorSchema },
+        { status: 413, description: "Request body exceeds the safe resource bound", schema: routeErrorSchema },
+        { status: 503, description: "Target lookup unavailable", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { POST };
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/templates/[templateId]/preview/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/documents/api/templates/%5BtemplateId%5D/preview/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { DocumentTemplate } from '../../../../data/entities'\nimport { documentTemplatePreviewSchema } from '../../../../data/validators'\nimport { prepareTemplateRender } from '../../../../lib/templateInstantiation'\nimport { DOCUMENTS_JSON_BODY_LIMITS } from '../../../../lib/requestBody'\nimport {\n  handleDocumentsRouteError,\n  readBody,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  withDocumentsContextErrors,\n} from '../../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ templateId: string }> | { templateId: string }\n}\n\nconst previewResponseSchema = z.object({\n  contentHtml: z.string(),\n  unresolvedTokens: z.array(z.string()),\n  templateUpdatedAt: z.string(),\n  previewDigest: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['documents.create'] },\n}\n\nexport async function POST(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const templateId = (await context.params).templateId\n    const ctx = await resolveDocumentsContext(request, ['documents.create'])\n    const input = documentTemplatePreviewSchema.parse(await readBody(\n      request,\n      DOCUMENTS_JSON_BODY_LIMITS.templateRender,\n    ))\n    const template = await findOneWithDecryption(\n      ctx.em,\n      DocumentTemplate,\n      {\n        id: templateId,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        deletedAt: null,\n        isActive: true,\n      },\n      undefined,\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n    )\n    if (!template) throw new CrudHttpError(404, { error: 'documents.templates.notFound' })\n    const prepared = await prepareTemplateRender({\n      request,\n      template,\n      title: input.title,\n      locale: input.locale,\n      effectiveDate: input.effectiveDate,\n      templateUpdatedAt: input.templateUpdatedAt,\n      slots: input.slots,\n      userFeatures: ctx.auth.features,\n    })\n    return NextResponse.json({\n      contentHtml: prepared.render.html,\n      unresolvedTokens: prepared.render.unresolvedTokens,\n      templateUpdatedAt: template.updatedAt.toISOString(),\n      previewDigest: prepared.previewDigest,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.templates.preview')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Preview a contextual document template',\n  pathParams: z.object({ templateId: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Render a template preview without writing data',\n      requestBody: { contentType: 'application/json', schema: documentTemplatePreviewSchema },\n      responses: [{ status: 200, description: 'Rendered template preview', schema: previewResponseSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Template not found', schema: routeErrorSchema },\n        { status: 409, description: 'Template revision changed', schema: routeErrorSchema },\n        { status: 413, description: 'Request body exceeds the safe resource bound', schema: routeErrorSchema },\n        { status: 503, description: 'Target lookup unavailable', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { POST }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,6BAA6B;AACtC,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AACjC,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,aAAa,EAAE,OAAO;AAAA,EACtB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACpC,mBAAmB,EAAE,OAAO;AAAA,EAC5B,eAAe,EAAE,OAAO;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KAAK,SAAkB,SAA0C;AACrF,MAAI;AACF,UAAM,cAAc,MAAM,QAAQ,QAAQ;AAC1C,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,kBAAkB,CAAC;AACvE,UAAM,QAAQ,8BAA8B,MAAM,MAAM;AAAA,MACtD;AAAA,MACA,2BAA2B;AAAA,IAC7B,CAAC;AACD,UAAM,WAAW,MAAM;AAAA,MACrB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,WAAW;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,MACA;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,IAC/D;AACA,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AACrF,UAAM,WAAW,MAAM,sBAAsB;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,OAAO,MAAM;AAAA,MACb,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,MACrB,mBAAmB,MAAM;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,cAAc,IAAI,KAAK;AAAA,IACzB,CAAC;AACD,WAAO,aAAa,KAAK;AAAA,MACvB,aAAa,SAAS,OAAO;AAAA,MAC7B,kBAAkB,SAAS,OAAO;AAAA,MAClC,mBAAmB,SAAS,UAAU,YAAY;AAAA,MAClD,eAAe,SAAS;AAAA,IAC1B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,6BAA6B;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EACtD,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MACtF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,sBAAsB,CAAC;AAAA,MACpG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,iBAAiB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,iBAAiB;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,iBAAiB;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK;",
+  "names": []
+}

package/dist/modules/documents/api/templates/[templateId]/route.js

@@ -0,0 +1,82 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { DocumentTemplate } from "../../../data/entities.js";
+import { documentTemplateContextSlotSchema } from "../../../data/validators.js";
+import {
+  handleDocumentsRouteError,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../_shared.js";
+const templateIdSchema = z.string().uuid();
+const templateDetailResponseSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  description: z.string().nullable(),
+  bodyHtml: z.string(),
+  contextSlots: z.array(documentTemplateContextSlotSchema).nullable(),
+  isActive: z.boolean(),
+  updatedAt: z.string(),
+  createdAt: z.string()
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.templates.manage"] }
+};
+async function GET(request, context) {
+  try {
+    const templateId = templateIdSchema.parse((await context.params).templateId);
+    const ctx = await resolveDocumentsContext(request, ["documents.templates.manage"]);
+    const template = await findOneWithDecryption(
+      ctx.em,
+      DocumentTemplate,
+      {
+        id: templateId,
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        deletedAt: null
+      },
+      void 0,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+    );
+    if (!template) throw new CrudHttpError(404, { error: "documents.templates.notFound" });
+    return NextResponse.json({
+      id: template.id,
+      name: template.name,
+      description: template.description ?? null,
+      bodyHtml: template.bodyHtml,
+      contextSlots: template.contextSlots ?? null,
+      isActive: template.isActive,
+      updatedAt: template.updatedAt.toISOString(),
+      createdAt: template.createdAt.toISOString()
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.templates.detail");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document template detail",
+  pathParams: z.object({ templateId: templateIdSchema }),
+  methods: {
+    GET: {
+      summary: "Get a document template including its body",
+      responses: [{ status: 200, description: "Template detail", schema: templateDetailResponseSchema }],
+      errors: [
+        { status: 400, description: "Invalid template id", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Template not found", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET };
+export {
+  GET,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/templates/[templateId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/documents/api/templates/%5BtemplateId%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { DocumentTemplate } from '../../../data/entities'\nimport { documentTemplateContextSlotSchema } from '../../../data/validators'\nimport {\n  handleDocumentsRouteError,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  withDocumentsContextErrors,\n} from '../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ templateId: string }> | { templateId: string }\n}\n\nconst templateIdSchema = z.string().uuid()\n\nconst templateDetailResponseSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  description: z.string().nullable(),\n  bodyHtml: z.string(),\n  contextSlots: z.array(documentTemplateContextSlotSchema).nullable(),\n  isActive: z.boolean(),\n  updatedAt: z.string(),\n  createdAt: z.string(),\n})\n\n// The detail endpoint exists to serve the template editor, which reveals the\n// full body. Gate it on the same manage feature as every template mutation so\n// a view-only user cannot read template boilerplate. Instantiation flows never\n// hit this route: they render slots via the list (bodies excluded) and the\n// server-side preview/instantiate endpoints.\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['documents.templates.manage'] },\n}\n\nexport async function GET(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const templateId = templateIdSchema.parse((await context.params).templateId)\n    const ctx = await resolveDocumentsContext(request, ['documents.templates.manage'])\n    const template = await findOneWithDecryption(\n      ctx.em,\n      DocumentTemplate,\n      {\n        id: templateId,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n    )\n    if (!template) throw new CrudHttpError(404, { error: 'documents.templates.notFound' })\n\n    return NextResponse.json({\n      id: template.id,\n      name: template.name,\n      description: template.description ?? null,\n      bodyHtml: template.bodyHtml,\n      contextSlots: template.contextSlots ?? null,\n      isActive: template.isActive,\n      updatedAt: template.updatedAt.toISOString(),\n      createdAt: template.createdAt.toISOString(),\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.templates.detail')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document template detail',\n  pathParams: z.object({ templateId: templateIdSchema }),\n  methods: {\n    GET: {\n      summary: 'Get a document template including its body',\n      responses: [{ status: 200, description: 'Template detail', schema: templateDetailResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid template id', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Template not found', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { GET }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,wBAAwB;AACjC,SAAS,yCAAyC;AAClD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAEzC,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,OAAO;AAAA,EACnB,cAAc,EAAE,MAAM,iCAAiC,EAAE,SAAS;AAAA,EAClE,UAAU,EAAE,QAAQ;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAOM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,eAAsB,IAAI,SAAkB,SAA0C;AACpF,MAAI;AACF,UAAM,aAAa,iBAAiB,OAAO,MAAM,QAAQ,QAAQ,UAAU;AAC3E,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,4BAA4B,CAAC;AACjF,UAAM,WAAW,MAAM;AAAA,MACrB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,IAC/D;AACA,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AAErF,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,SAAS;AAAA,MACb,MAAM,SAAS;AAAA,MACf,aAAa,SAAS,eAAe;AAAA,MACrC,UAAU,SAAS;AAAA,MACnB,cAAc,SAAS,gBAAgB;AAAA,MACvC,UAAU,SAAS;AAAA,MACnB,WAAW,SAAS,UAAU,YAAY;AAAA,MAC1C,WAAW,SAAS,UAAU,YAAY;AAAA,IAC5C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,4BAA4B;AAAA,EACtE;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,YAAY,iBAAiB,CAAC;AAAA,EACrD,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,6BAA6B,CAAC;AAAA,MACjG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,IAAI;",
+  "names": []
+}