@open-mercato/documents 0.6.8-develop.7016.1.4ed7b1e49d

package/dist/modules/documents/api/[id]/principals/route.js

@@ -0,0 +1,299 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import {
+  SortDir
+} from "@open-mercato/shared/lib/query/types";
+import { sortRowsInMemory } from "@open-mercato/shared/lib/query/encrypted-sort";
+import { resolveSearchMinTokenLength } from "@open-mercato/shared/lib/search/config";
+import {
+  firstSafeDocumentsDisplayLabel,
+  sanitizeDocumentsDisplayLabel
+} from "../../../lib/displayLabels.js";
+import { resolveUserLabels } from "../../../lib/userLabels.js";
+import { resolveAuthPrincipalService } from "../../../lib/platformServices.js";
+import { DocumentShare } from "../../../data/entities.js";
+import {
+  handleDocumentsRouteError,
+  resolveDocumentCapabilityProjection,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  withDocumentsContextErrors
+} from "../../_shared.js";
+const principalTypeSchema = z.enum(["user", "role"]);
+const principalModeSchema = z.enum(["mention", "share"]);
+const MAX_PRINCIPAL_PAGES = 50;
+const MAX_PRINCIPAL_PAGE_SIZE = 20;
+const PRINCIPAL_SEARCH_MIN_LENGTH = resolveSearchMinTokenLength();
+const boundedSearchSchema = z.preprocess(
+  (value) => {
+    if (typeof value !== "string") return value;
+    const normalized = value.trim();
+    return normalized.length === 0 ? void 0 : normalized;
+  },
+  z.string().min(PRINCIPAL_SEARCH_MIN_LENGTH).max(120).optional()
+);
+const principalsQuerySchema = z.object({
+  mode: principalModeSchema.default("share"),
+  type: principalTypeSchema.default("user"),
+  search: boundedSearchSchema,
+  page: z.coerce.number().int().min(1).max(MAX_PRINCIPAL_PAGES).default(1),
+  pageSize: z.coerce.number().int().min(1).max(MAX_PRINCIPAL_PAGE_SIZE).default(MAX_PRINCIPAL_PAGE_SIZE)
+}).superRefine((value, context) => {
+  if (value.mode === "mention" && value.type !== "user") {
+    context.addIssue({ code: "custom", path: ["type"], message: "documents.principals.mentionUsersOnly" });
+  }
+});
+const principalItemSchema = z.object({
+  id: z.string().uuid(),
+  label: z.string(),
+  secondary: z.string().nullable()
+});
+const principalsResponseSchema = z.object({
+  items: z.array(principalItemSchema),
+  page: z.number().int().positive(),
+  pageSize: z.number().int().positive(),
+  total: z.number().int().nonnegative(),
+  totalPages: z.number().int().positive()
+});
+const PRINCIPAL_ENTITY_IDS = {
+  user: "auth:user",
+  role: "auth:role"
+};
+const PRINCIPAL_SORT = [{ field: "id", dir: SortDir.Asc }];
+function readString(record, ...keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  }
+  return null;
+}
+function buildSearchPattern(search) {
+  return `%${escapeLikePattern(search)}%`;
+}
+function excludedPrincipalFilter(excludedIds) {
+  return excludedIds.length > 0 ? { id: { $nin: [...excludedIds] } } : {};
+}
+function buildPrincipalFilters(type, search, excludedIds) {
+  if (type === "user") {
+    return search ? {
+      is_confirmed: true,
+      name: { $ilike: buildSearchPattern(search) },
+      ...excludedPrincipalFilter(excludedIds)
+    } : { is_confirmed: true, ...excludedPrincipalFilter(excludedIds) };
+  }
+  if (!search) return excludedIds.length > 0 ? excludedPrincipalFilter(excludedIds) : void 0;
+  return {
+    name: { $ilike: buildSearchPattern(search) },
+    ...excludedPrincipalFilter(excludedIds)
+  };
+}
+function buildUserSearchFilters(search, field, excludedIds) {
+  const pattern = `%${escapeLikePattern(search)}%`;
+  return {
+    is_confirmed: true,
+    ...field === "name" || field === "intersection" ? { name: { $ilike: pattern } } : {},
+    ...field === "email" || field === "intersection" ? { email: { $ilike: pattern } } : {},
+    ...excludedPrincipalFilter(excludedIds)
+  };
+}
+function buildPrincipalQueryOptions(input) {
+  return {
+    // User name/email are encrypted. QueryEngine only selects matching ids;
+    // the scoped decryption helper resolves display labels after pagination.
+    fields: input.fields ?? (input.type === "user" ? ["id"] : ["id", "name"]),
+    tenantId: input.tenantId,
+    // QueryEngine's organizationIds contract treats an empty entry as the
+    // tenant-wide NULL partition. This includes users assigned to this document
+    // organization plus tenant-wide users while still applying tokenized search
+    // and automatic tenant/soft-delete guards.
+    ...input.type === "user" ? { organizationIds: [input.organizationId, ""] } : {},
+    withDeleted: false,
+    filters: input.filters ?? buildPrincipalFilters(input.type, input.search, input.excludedIds),
+    sort: input.sort ?? [...PRINCIPAL_SORT],
+    page: { page: input.page, pageSize: input.pageSize }
+  };
+}
+function safeQueryTotal(result) {
+  return Number.isFinite(result.total) && result.total > 0 ? Math.floor(result.total) : 0;
+}
+async function queryPrincipalPage(input) {
+  if (input.type !== "user" || !input.search) {
+    return input.queryEngine.query(
+      PRINCIPAL_ENTITY_IDS[input.type],
+      buildPrincipalQueryOptions(input)
+    );
+  }
+  const prefixSize = input.page * input.pageSize;
+  const common = {
+    ...input,
+    page: 1,
+    pageSize: prefixSize
+  };
+  const [nameMatches, emailMatches, intersection] = await Promise.all([
+    input.queryEngine.query(
+      PRINCIPAL_ENTITY_IDS.user,
+      buildPrincipalQueryOptions({
+        ...common,
+        filters: buildUserSearchFilters(input.search, "name", input.excludedIds)
+      })
+    ),
+    input.queryEngine.query(
+      PRINCIPAL_ENTITY_IDS.user,
+      buildPrincipalQueryOptions({
+        ...common,
+        filters: buildUserSearchFilters(input.search, "email", input.excludedIds)
+      })
+    ),
+    input.queryEngine.query(
+      PRINCIPAL_ENTITY_IDS.user,
+      buildPrincipalQueryOptions({
+        ...common,
+        pageSize: 1,
+        fields: ["id"],
+        filters: buildUserSearchFilters(input.search, "intersection", input.excludedIds),
+        sort: [{ field: "id", dir: SortDir.Asc }]
+      })
+    )
+  ]);
+  const byId = /* @__PURE__ */ new Map();
+  for (const item of [...nameMatches.items, ...emailMatches.items]) {
+    const id = readString(item, "id");
+    if (id && !byId.has(id)) byId.set(id, item);
+  }
+  const merged = sortRowsInMemory(Array.from(byId.values()), [...PRINCIPAL_SORT]);
+  const offset = (input.page - 1) * input.pageSize;
+  const items = merged.slice(offset, offset + input.pageSize);
+  const nameTotal = safeQueryTotal(nameMatches);
+  const emailTotal = safeQueryTotal(emailMatches);
+  const overlapTotal = Math.min(nameTotal, emailTotal, safeQueryTotal(intersection));
+  const total = Math.max(byId.size, nameTotal + emailTotal - overlapTotal);
+  return { items, page: input.page, pageSize: input.pageSize, total };
+}
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.view"] }
+};
+async function GET(request, context) {
+  try {
+    const { id: documentId } = await context.params;
+    const url = new URL(request.url);
+    const query = principalsQuerySchema.parse(Object.fromEntries(url.searchParams.entries()));
+    const requiredFeature = query.mode === "mention" ? "documents.view" : "documents.share";
+    const ctx = await resolveDocumentsContext(request, [requiredFeature]);
+    const projection = await resolveDocumentCapabilityProjection(ctx, documentId);
+    const allowed = query.mode === "mention" ? projection.capabilities.canComment : projection.capabilities.canShare;
+    if (!allowed) throw new CrudHttpError(403, { error: "api.errors.forbidden" });
+    const authPrincipalService = resolveAuthPrincipalService(ctx.container);
+    if (!authPrincipalService) throw new CrudHttpError(403, { error: "api.errors.forbidden" });
+    const protectedUserIds = !ctx.auth.isSuperAdmin && query.type === "user" ? await authPrincipalService.listSuperAdminUserIds(ctx.tenantId) : [];
+    const existingShares = query.mode === "share" ? await findWithDecryption(
+      ctx.em,
+      DocumentShare,
+      {
+        documentId,
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        principalType: query.type,
+        deletedAt: null
+      },
+      { fields: ["principalId"] },
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+    ) : [];
+    const excludedIds = Array.from(/* @__PURE__ */ new Set([
+      ...protectedUserIds,
+      ...existingShares.map((share) => share.principalId)
+    ]));
+    let result;
+    if (query.type === "role") {
+      if (typeof authPrincipalService.queryActiveRolePage !== "function") {
+        throw new CrudHttpError(403, { error: "api.errors.forbidden" });
+      }
+      const rolePage = await authPrincipalService.queryActiveRolePage({
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+        search: query.search,
+        excludedIds,
+        page: query.page,
+        pageSize: query.pageSize
+      });
+      result = { ...rolePage, items: rolePage.items.map((item) => ({ ...item })) };
+    } else {
+      const queryEngine = ctx.container.resolve("queryEngine");
+      result = await queryPrincipalPage({
+        queryEngine,
+        type: query.type,
+        search: query.search,
+        page: query.page,
+        pageSize: query.pageSize,
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        excludedIds
+      });
+    }
+    const { translate } = await resolveTranslations();
+    const fallbackLabel = query.type === "user" ? translate("documents.users.unknown", "Unknown user") : translate("documents.roles.unknown", "Unknown role");
+    const safeFallback = sanitizeDocumentsDisplayLabel(fallbackLabel) ?? (query.type === "user" ? "Unknown user" : "Unknown role");
+    const userLabels = query.type === "user" ? await resolveUserLabels(
+      ctx.container,
+      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+      result.items.flatMap((item) => {
+        const id = readString(item, "id");
+        return id ? [id] : [];
+      })
+    ) : null;
+    const items = result.items.flatMap((item) => {
+      const id = readString(item, "id");
+      if (!id) return [];
+      const resolvedUser = userLabels?.get(id) ?? null;
+      const label = firstSafeDocumentsDisplayLabel(
+        resolvedUser?.label,
+        readString(item, "label", "name"),
+        safeFallback
+      ) ?? safeFallback;
+      const secondary = sanitizeDocumentsDisplayLabel(
+        resolvedUser?.secondary ?? readString(item, "secondary")
+      );
+      return [{ id, label, secondary }];
+    });
+    const total = Math.max(0, Number.isFinite(result.total) ? result.total : items.length);
+    const totalPages = Math.min(
+      MAX_PRINCIPAL_PAGES,
+      Math.max(1, Math.ceil(total / query.pageSize))
+    );
+    return NextResponse.json(
+      { items, page: query.page, pageSize: query.pageSize, total, totalPages },
+      { headers: { "Cache-Control": "private, no-store" } }
+    );
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.principals.list");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document-scoped principal picker",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "List principals eligible for document mentions or sharing",
+      description: "Returns a bounded, document-authorized user or role page without requiring broad Auth administration grants.",
+      query: principalsQuerySchema,
+      responses: [{ status: 200, description: "Eligible principal page", schema: principalsResponseSchema }],
+      errors: [
+        { status: 400, description: "Invalid picker query", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Document capability denied", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET };
+export {
+  GET,
+  route_default as default,
+  metadata,
+  openApi,
+  principalsQuerySchema
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/[id]/principals/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/documents/api/%5Bid%5D/principals/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport {\n  SortDir,\n  type QueryEngine,\n  type QueryOptions,\n  type QueryResult,\n} from '@open-mercato/shared/lib/query/types'\nimport { sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'\nimport { resolveSearchMinTokenLength } from '@open-mercato/shared/lib/search/config'\nimport {\n  firstSafeDocumentsDisplayLabel,\n  sanitizeDocumentsDisplayLabel,\n} from '../../../lib/displayLabels'\nimport { resolveUserLabels } from '../../../lib/userLabels'\nimport { resolveAuthPrincipalService } from '../../../lib/platformServices'\nimport { DocumentShare } from '../../../data/entities'\nimport {\n  handleDocumentsRouteError,\n  resolveDocumentCapabilityProjection,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  withDocumentsContextErrors,\n} from '../../_shared'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst principalTypeSchema = z.enum(['user', 'role'])\nconst principalModeSchema = z.enum(['mention', 'share'])\nconst MAX_PRINCIPAL_PAGES = 50\nconst MAX_PRINCIPAL_PAGE_SIZE = 20\nconst PRINCIPAL_SEARCH_MIN_LENGTH = resolveSearchMinTokenLength()\nconst boundedSearchSchema = z.preprocess(\n  (value) => {\n    if (typeof value !== 'string') return value\n    const normalized = value.trim()\n    return normalized.length === 0 ? undefined : normalized\n  },\n  z.string().min(PRINCIPAL_SEARCH_MIN_LENGTH).max(120).optional(),\n)\n\nexport const principalsQuerySchema = z.object({\n  mode: principalModeSchema.default('share'),\n  type: principalTypeSchema.default('user'),\n  search: boundedSearchSchema,\n  page: z.coerce.number().int().min(1).max(MAX_PRINCIPAL_PAGES).default(1),\n  pageSize: z.coerce.number().int().min(1).max(MAX_PRINCIPAL_PAGE_SIZE).default(MAX_PRINCIPAL_PAGE_SIZE),\n}).superRefine((value, context) => {\n  if (value.mode === 'mention' && value.type !== 'user') {\n    context.addIssue({ code: 'custom', path: ['type'], message: 'documents.principals.mentionUsersOnly' })\n  }\n})\n\nconst principalItemSchema = z.object({\n  id: z.string().uuid(),\n  label: z.string(),\n  secondary: z.string().nullable(),\n})\n\nconst principalsResponseSchema = z.object({\n  items: z.array(principalItemSchema),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  total: z.number().int().nonnegative(),\n  totalPages: z.number().int().positive(),\n})\n\nconst PRINCIPAL_ENTITY_IDS = {\n  user: 'auth:user',\n  role: 'auth:role',\n} as const\n\ntype PrincipalType = z.infer<typeof principalTypeSchema>\ntype PrincipalRecord = Record<string, unknown>\n\n// `name` and `email` are encrypted. Sorting either in QueryEngine disables the\n// database limit so it can decrypt and sort the complete result set. A stable\n// id order keeps every branch SQL-pageable; the picker remains search-first.\nconst PRINCIPAL_SORT = [{ field: 'id', dir: SortDir.Asc }] as const\n\nfunction readString(record: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = record[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return null\n}\n\nfunction buildSearchPattern(search: string): string {\n  return `%${escapeLikePattern(search)}%`\n}\n\nfunction excludedPrincipalFilter(excludedIds: readonly string[]) {\n  return excludedIds.length > 0 ? { id: { $nin: [...excludedIds] } } : {}\n}\n\nfunction buildPrincipalFilters(\n  type: PrincipalType,\n  search: string | undefined,\n  excludedIds: readonly string[],\n) {\n  if (type === 'user') {\n    return search\n      ? {\n          is_confirmed: true,\n          name: { $ilike: buildSearchPattern(search) },\n          ...excludedPrincipalFilter(excludedIds),\n        }\n      : { is_confirmed: true, ...excludedPrincipalFilter(excludedIds) }\n  }\n  if (!search) return excludedIds.length > 0 ? excludedPrincipalFilter(excludedIds) : undefined\n  return {\n    name: { $ilike: buildSearchPattern(search) },\n    ...excludedPrincipalFilter(excludedIds),\n  }\n}\n\nfunction buildUserSearchFilters(\n  search: string,\n  field: 'name' | 'email' | 'intersection',\n  excludedIds: readonly string[],\n) {\n  const pattern = `%${escapeLikePattern(search)}%`\n  return {\n    is_confirmed: true,\n    ...(field === 'name' || field === 'intersection' ? { name: { $ilike: pattern } } : {}),\n    ...(field === 'email' || field === 'intersection' ? { email: { $ilike: pattern } } : {}),\n    ...excludedPrincipalFilter(excludedIds),\n  }\n}\n\nfunction buildPrincipalQueryOptions(input: {\n  type: PrincipalType\n  search?: string\n  page: number\n  pageSize: number\n  tenantId: string\n  organizationId: string\n  excludedIds: readonly string[]\n  filters?: QueryOptions['filters']\n  fields?: string[]\n  sort?: QueryOptions['sort']\n}): QueryOptions {\n  return {\n    // User name/email are encrypted. QueryEngine only selects matching ids;\n    // the scoped decryption helper resolves display labels after pagination.\n    fields: input.fields ?? (input.type === 'user' ? ['id'] : ['id', 'name']),\n    tenantId: input.tenantId,\n    // QueryEngine's organizationIds contract treats an empty entry as the\n    // tenant-wide NULL partition. This includes users assigned to this document\n    // organization plus tenant-wide users while still applying tokenized search\n    // and automatic tenant/soft-delete guards.\n    ...(input.type === 'user' ? { organizationIds: [input.organizationId, ''] } : {}),\n    withDeleted: false,\n    filters: input.filters ?? buildPrincipalFilters(input.type, input.search, input.excludedIds),\n    sort: input.sort ?? [...PRINCIPAL_SORT],\n    page: { page: input.page, pageSize: input.pageSize },\n  }\n}\n\nfunction safeQueryTotal(result: QueryResult<PrincipalRecord>): number {\n  return Number.isFinite(result.total) && result.total > 0 ? Math.floor(result.total) : 0\n}\n\nasync function queryPrincipalPage(input: {\n  queryEngine: QueryEngine\n  type: PrincipalType\n  search?: string\n  page: number\n  pageSize: number\n  tenantId: string\n  organizationId: string\n  excludedIds: readonly string[]\n}): Promise<QueryResult<PrincipalRecord>> {\n  if (input.type !== 'user' || !input.search) {\n    return input.queryEngine.query<PrincipalRecord>(\n      PRINCIPAL_ENTITY_IDS[input.type],\n      buildPrincipalQueryOptions(input),\n    )\n  }\n\n  // A QueryEngine `$or` group compiles base-field comparisons directly. That is\n  // unsafe for encrypted auth:user fields because the raw email ciphertext can\n  // never satisfy ILIKE. Keep each search predicate flat so both Basic and\n  // Hybrid engines route it through search_tokens. The intersection count makes\n  // the union total exact without loading every duplicate solely to count it.\n  const prefixSize = input.page * input.pageSize\n  const common = {\n    ...input,\n    page: 1,\n    pageSize: prefixSize,\n  }\n  const [nameMatches, emailMatches, intersection] = await Promise.all([\n    input.queryEngine.query<PrincipalRecord>(\n      PRINCIPAL_ENTITY_IDS.user,\n      buildPrincipalQueryOptions({\n        ...common,\n        filters: buildUserSearchFilters(input.search, 'name', input.excludedIds),\n      }),\n    ),\n    input.queryEngine.query<PrincipalRecord>(\n      PRINCIPAL_ENTITY_IDS.user,\n      buildPrincipalQueryOptions({\n        ...common,\n        filters: buildUserSearchFilters(input.search, 'email', input.excludedIds),\n      }),\n    ),\n    input.queryEngine.query<PrincipalRecord>(\n      PRINCIPAL_ENTITY_IDS.user,\n      buildPrincipalQueryOptions({\n        ...common,\n        pageSize: 1,\n        fields: ['id'],\n        filters: buildUserSearchFilters(input.search, 'intersection', input.excludedIds),\n        sort: [{ field: 'id', dir: SortDir.Asc }],\n      }),\n    ),\n  ])\n\n  const byId = new Map<string, PrincipalRecord>()\n  for (const item of [...nameMatches.items, ...emailMatches.items]) {\n    const id = readString(item, 'id')\n    if (id && !byId.has(id)) byId.set(id, item)\n  }\n  const merged = sortRowsInMemory(Array.from(byId.values()), [...PRINCIPAL_SORT])\n  const offset = (input.page - 1) * input.pageSize\n  const items = merged.slice(offset, offset + input.pageSize)\n  const nameTotal = safeQueryTotal(nameMatches)\n  const emailTotal = safeQueryTotal(emailMatches)\n  const overlapTotal = Math.min(nameTotal, emailTotal, safeQueryTotal(intersection))\n  const total = Math.max(byId.size, nameTotal + emailTotal - overlapTotal)\n\n  return { items, page: input.page, pageSize: input.pageSize, total }\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['documents.view'] },\n}\n\nexport async function GET(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const { id: documentId } = await context.params\n    const url = new URL(request.url)\n    const query = principalsQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))\n    const requiredFeature = query.mode === 'mention' ? 'documents.view' : 'documents.share'\n    const ctx = await resolveDocumentsContext(request, [requiredFeature])\n    const projection = await resolveDocumentCapabilityProjection(ctx, documentId)\n    const allowed = query.mode === 'mention'\n      ? projection.capabilities.canComment\n      : projection.capabilities.canShare\n    if (!allowed) throw new CrudHttpError(403, { error: 'api.errors.forbidden' })\n\n    const authPrincipalService = resolveAuthPrincipalService(ctx.container)\n    if (!authPrincipalService) throw new CrudHttpError(403, { error: 'api.errors.forbidden' })\n    const protectedUserIds: string[] = !ctx.auth.isSuperAdmin && query.type === 'user'\n      ? await authPrincipalService.listSuperAdminUserIds(ctx.tenantId)\n      : []\n    const existingShares = query.mode === 'share'\n      ? await findWithDecryption(\n          ctx.em,\n          DocumentShare,\n          {\n            documentId,\n            tenantId: ctx.tenantId,\n            organizationId: ctx.organizationId,\n            principalType: query.type,\n            deletedAt: null,\n          },\n          { fields: ['principalId'] as const },\n          { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n        )\n      : []\n    const excludedIds = Array.from(new Set([\n      ...protectedUserIds,\n      ...existingShares.map((share) => share.principalId),\n    ]))\n    let result: QueryResult<PrincipalRecord>\n    if (query.type === 'role') {\n      if (typeof authPrincipalService.queryActiveRolePage !== 'function') {\n        throw new CrudHttpError(403, { error: 'api.errors.forbidden' })\n      }\n      const rolePage = await authPrincipalService.queryActiveRolePage({\n        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n        search: query.search,\n        excludedIds,\n        page: query.page,\n        pageSize: query.pageSize,\n      })\n      result = { ...rolePage, items: rolePage.items.map((item) => ({ ...item })) }\n    } else {\n      const queryEngine = ctx.container.resolve('queryEngine') as QueryEngine\n      result = await queryPrincipalPage({\n        queryEngine,\n        type: query.type,\n        search: query.search,\n        page: query.page,\n        pageSize: query.pageSize,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        excludedIds,\n      })\n    }\n    const { translate } = await resolveTranslations()\n    const fallbackLabel = query.type === 'user'\n      ? translate('documents.users.unknown', 'Unknown user')\n      : translate('documents.roles.unknown', 'Unknown role')\n    const safeFallback = sanitizeDocumentsDisplayLabel(fallbackLabel)\n      ?? (query.type === 'user' ? 'Unknown user' : 'Unknown role')\n    const userLabels = query.type === 'user'\n      ? await resolveUserLabels(\n          ctx.container,\n          { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n          result.items.flatMap((item) => {\n            const id = readString(item, 'id')\n            return id ? [id] : []\n          }),\n        )\n      : null\n    const items = result.items.flatMap((item) => {\n      const id = readString(item, 'id')\n      if (!id) return []\n      const resolvedUser = userLabels?.get(id) ?? null\n      const label = firstSafeDocumentsDisplayLabel(\n        resolvedUser?.label,\n        readString(item, 'label', 'name'),\n        safeFallback,\n      ) ?? safeFallback\n      const secondary = sanitizeDocumentsDisplayLabel(\n        resolvedUser?.secondary ?? readString(item, 'secondary'),\n      )\n      return [{ id, label, secondary }]\n    })\n    const total = Math.max(0, Number.isFinite(result.total) ? result.total : items.length)\n    const totalPages = Math.min(\n      MAX_PRINCIPAL_PAGES,\n      Math.max(1, Math.ceil(total / query.pageSize)),\n    )\n\n    return NextResponse.json(\n      { items, page: query.page, pageSize: query.pageSize, total, totalPages },\n      { headers: { 'Cache-Control': 'private, no-store' } },\n    )\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.principals.list')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document-scoped principal picker',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'List principals eligible for document mentions or sharing',\n      description:\n        'Returns a bounded, document-authorized user or role page without requiring broad Auth administration grants.',\n      query: principalsQuerySchema,\n      responses: [{ status: 200, description: 'Eligible principal page', schema: principalsResponseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid picker query', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Document capability denied', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { GET }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,sBAAsB,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;AACnD,MAAM,sBAAsB,EAAE,KAAK,CAAC,WAAW,OAAO,CAAC;AACvD,MAAM,sBAAsB;AAC5B,MAAM,0BAA0B;AAChC,MAAM,8BAA8B,4BAA4B;AAChE,MAAM,sBAAsB,EAAE;AAAA,EAC5B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,SAAU,QAAO;AACtC,UAAM,aAAa,MAAM,KAAK;AAC9B,WAAO,WAAW,WAAW,IAAI,SAAY;AAAA,EAC/C;AAAA,EACA,EAAE,OAAO,EAAE,IAAI,2BAA2B,EAAE,IAAI,GAAG,EAAE,SAAS;AAChE;AAEO,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,oBAAoB,QAAQ,OAAO;AAAA,EACzC,MAAM,oBAAoB,QAAQ,MAAM;AAAA,EACxC,QAAQ;AAAA,EACR,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,mBAAmB,EAAE,QAAQ,CAAC;AAAA,EACvE,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,uBAAuB,EAAE,QAAQ,uBAAuB;AACvG,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAI,MAAM,SAAS,aAAa,MAAM,SAAS,QAAQ;AACrD,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,wCAAwC,CAAC;AAAA,EACvG;AACF,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,MAAM,mBAAmB;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,uBAAuB;AAAA,EAC3B,MAAM;AAAA,EACN,MAAM;AACR;AAQA,MAAM,iBAAiB,CAAC,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC;AAEzD,SAAS,WAAW,WAAoC,MAA+B;AACrF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,QAAwB;AAClD,SAAO,IAAI,kBAAkB,MAAM,CAAC;AACtC;AAEA,SAAS,wBAAwB,aAAgC;AAC/D,SAAO,YAAY,SAAS,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,WAAW,EAAE,EAAE,IAAI,CAAC;AACxE;AAEA,SAAS,sBACP,MACA,QACA,aACA;AACA,MAAI,SAAS,QAAQ;AACnB,WAAO,SACH;AAAA,MACE,cAAc;AAAA,MACd,MAAM,EAAE,QAAQ,mBAAmB,MAAM,EAAE;AAAA,MAC3C,GAAG,wBAAwB,WAAW;AAAA,IACxC,IACA,EAAE,cAAc,MAAM,GAAG,wBAAwB,WAAW,EAAE;AAAA,EACpE;AACA,MAAI,CAAC,OAAQ,QAAO,YAAY,SAAS,IAAI,wBAAwB,WAAW,IAAI;AACpF,SAAO;AAAA,IACL,MAAM,EAAE,QAAQ,mBAAmB,MAAM,EAAE;AAAA,IAC3C,GAAG,wBAAwB,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,uBACP,QACA,OACA,aACA;AACA,QAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,SAAO;AAAA,IACL,cAAc;AAAA,IACd,GAAI,UAAU,UAAU,UAAU,iBAAiB,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,IAAI,CAAC;AAAA,IACpF,GAAI,UAAU,WAAW,UAAU,iBAAiB,EAAE,OAAO,EAAE,QAAQ,QAAQ,EAAE,IAAI,CAAC;AAAA,IACtF,GAAG,wBAAwB,WAAW;AAAA,EACxC;AACF;AAEA,SAAS,2BAA2B,OAWnB;AACf,SAAO;AAAA;AAAA;AAAA,IAGL,QAAQ,MAAM,WAAW,MAAM,SAAS,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM;AAAA,IACvE,UAAU,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,GAAI,MAAM,SAAS,SAAS,EAAE,iBAAiB,CAAC,MAAM,gBAAgB,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,aAAa;AAAA,IACb,SAAS,MAAM,WAAW,sBAAsB,MAAM,MAAM,MAAM,QAAQ,MAAM,WAAW;AAAA,IAC3F,MAAM,MAAM,QAAQ,CAAC,GAAG,cAAc;AAAA,IACtC,MAAM,EAAE,MAAM,MAAM,MAAM,UAAU,MAAM,SAAS;AAAA,EACrD;AACF;AAEA,SAAS,eAAe,QAA8C;AACpE,SAAO,OAAO,SAAS,OAAO,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,MAAM,OAAO,KAAK,IAAI;AACxF;AAEA,eAAe,mBAAmB,OASQ;AACxC,MAAI,MAAM,SAAS,UAAU,CAAC,MAAM,QAAQ;AAC1C,WAAO,MAAM,YAAY;AAAA,MACvB,qBAAqB,MAAM,IAAI;AAAA,MAC/B,2BAA2B,KAAK;AAAA,IAClC;AAAA,EACF;AAOA,QAAM,aAAa,MAAM,OAAO,MAAM;AACtC,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,MAAM;AAAA,IACN,UAAU;AAAA,EACZ;AACA,QAAM,CAAC,aAAa,cAAc,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IAClE,MAAM,YAAY;AAAA,MAChB,qBAAqB;AAAA,MACrB,2BAA2B;AAAA,QACzB,GAAG;AAAA,QACH,SAAS,uBAAuB,MAAM,QAAQ,QAAQ,MAAM,WAAW;AAAA,MACzE,CAAC;AAAA,IACH;AAAA,IACA,MAAM,YAAY;AAAA,MAChB,qBAAqB;AAAA,MACrB,2BAA2B;AAAA,QACzB,GAAG;AAAA,QACH,SAAS,uBAAuB,MAAM,QAAQ,SAAS,MAAM,WAAW;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,IACA,MAAM,YAAY;AAAA,MAChB,qBAAqB;AAAA,MACrB,2BAA2B;AAAA,QACzB,GAAG;AAAA,QACH,UAAU;AAAA,QACV,QAAQ,CAAC,IAAI;AAAA,QACb,SAAS,uBAAuB,MAAM,QAAQ,gBAAgB,MAAM,WAAW;AAAA,QAC/E,MAAM,CAAC,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAED,QAAM,OAAO,oBAAI,IAA6B;AAC9C,aAAW,QAAQ,CAAC,GAAG,YAAY,OAAO,GAAG,aAAa,KAAK,GAAG;AAChE,UAAM,KAAK,WAAW,MAAM,IAAI;AAChC,QAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAG,MAAK,IAAI,IAAI,IAAI;AAAA,EAC5C;AACA,QAAM,SAAS,iBAAiB,MAAM,KAAK,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC;AAC9E,QAAM,UAAU,MAAM,OAAO,KAAK,MAAM;AACxC,QAAM,QAAQ,OAAO,MAAM,QAAQ,SAAS,MAAM,QAAQ;AAC1D,QAAM,YAAY,eAAe,WAAW;AAC5C,QAAM,aAAa,eAAe,YAAY;AAC9C,QAAM,eAAe,KAAK,IAAI,WAAW,YAAY,eAAe,YAAY,CAAC;AACjF,QAAM,QAAQ,KAAK,IAAI,KAAK,MAAM,YAAY,aAAa,YAAY;AAEvE,SAAO,EAAE,OAAO,MAAM,MAAM,MAAM,UAAU,MAAM,UAAU,MAAM;AACpE;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEA,eAAsB,IAAI,SAAkB,SAA0C;AACpF,MAAI;AACF,UAAM,EAAE,IAAI,WAAW,IAAI,MAAM,QAAQ;AACzC,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,sBAAsB,MAAM,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACxF,UAAM,kBAAkB,MAAM,SAAS,YAAY,mBAAmB;AACtE,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,eAAe,CAAC;AACpE,UAAM,aAAa,MAAM,oCAAoC,KAAK,UAAU;AAC5E,UAAM,UAAU,MAAM,SAAS,YAC3B,WAAW,aAAa,aACxB,WAAW,aAAa;AAC5B,QAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAE5E,UAAM,uBAAuB,4BAA4B,IAAI,SAAS;AACtE,QAAI,CAAC,qBAAsB,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACzF,UAAM,mBAA6B,CAAC,IAAI,KAAK,gBAAgB,MAAM,SAAS,SACxE,MAAM,qBAAqB,sBAAsB,IAAI,QAAQ,IAC7D,CAAC;AACL,UAAM,iBAAiB,MAAM,SAAS,UAClC,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,eAAe,MAAM;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,QAAQ,CAAC,aAAa,EAAW;AAAA,MACnC,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,IAC/D,IACA,CAAC;AACL,UAAM,cAAc,MAAM,KAAK,oBAAI,IAAI;AAAA,MACrC,GAAG;AAAA,MACH,GAAG,eAAe,IAAI,CAAC,UAAU,MAAM,WAAW;AAAA,IACpD,CAAC,CAAC;AACF,QAAI;AACJ,QAAI,MAAM,SAAS,QAAQ;AACzB,UAAI,OAAO,qBAAqB,wBAAwB,YAAY;AAClE,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AACA,YAAM,WAAW,MAAM,qBAAqB,oBAAoB;AAAA,QAC9D,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,QACpE,QAAQ,MAAM;AAAA,QACd;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,UAAU,MAAM;AAAA,MAClB,CAAC;AACD,eAAS,EAAE,GAAG,UAAU,OAAO,SAAS,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE;AAAA,IAC7E,OAAO;AACL,YAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,eAAS,MAAM,mBAAmB;AAAA,QAChC;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,QAAQ,MAAM;AAAA,QACd,MAAM,MAAM;AAAA,QACZ,UAAU,MAAM;AAAA,QAChB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,gBAAgB,MAAM,SAAS,SACjC,UAAU,2BAA2B,cAAc,IACnD,UAAU,2BAA2B,cAAc;AACvD,UAAM,eAAe,8BAA8B,aAAa,MAC1D,MAAM,SAAS,SAAS,iBAAiB;AAC/C,UAAM,aAAa,MAAM,SAAS,SAC9B,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MAC7D,OAAO,MAAM,QAAQ,CAAC,SAAS;AAC7B,cAAM,KAAK,WAAW,MAAM,IAAI;AAChC,eAAO,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,MACtB,CAAC;AAAA,IACH,IACA;AACJ,UAAM,QAAQ,OAAO,MAAM,QAAQ,CAAC,SAAS;AAC3C,YAAM,KAAK,WAAW,MAAM,IAAI;AAChC,UAAI,CAAC,GAAI,QAAO,CAAC;AACjB,YAAM,eAAe,YAAY,IAAI,EAAE,KAAK;AAC5C,YAAM,QAAQ;AAAA,QACZ,cAAc;AAAA,QACd,WAAW,MAAM,SAAS,MAAM;AAAA,QAChC;AAAA,MACF,KAAK;AACL,YAAM,YAAY;AAAA,QAChB,cAAc,aAAa,WAAW,MAAM,WAAW;AAAA,MACzD;AACA,aAAO,CAAC,EAAE,IAAI,OAAO,UAAU,CAAC;AAAA,IAClC,CAAC;AACD,UAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,SAAS,OAAO,KAAK,IAAI,OAAO,QAAQ,MAAM,MAAM;AACrF,UAAM,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/C;AAEA,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,MAAM,UAAU,MAAM,UAAU,OAAO,WAAW;AAAA,MACvE,EAAE,SAAS,EAAE,iBAAiB,oBAAoB,EAAE;AAAA,IACtD;AAAA,EACF,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,2BAA2B;AAAA,EACrE;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,OAAO;AAAA,MACP,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,yBAAyB,CAAC;AAAA,MACrG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,iBAAiB;AAAA,MACrF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,IAAI;",
+  "names": []
+}

package/dist/modules/documents/api/[id]/route.js

@@ -0,0 +1,246 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { documentUpdateSchema } from "../../data/validators.js";
+import { DOCUMENTS_ENTITY_IDS } from "../../lib/constants.js";
+import { deriveDocumentCapabilities } from "../../lib/capabilities.js";
+import { isDocumentFavorite } from "../../lib/favorites.js";
+import { isDocumentWatched } from "../../lib/watchers.js";
+import {
+  assertDocumentNotArchived,
+  handleDocumentsRouteError,
+  hasDocumentsFeature,
+  loadScopedDocument,
+  readBody,
+  resolveActorUserId,
+  resolveDocumentCapabilityProjection,
+  resolveDocumentsContext,
+  routeErrorSchema,
+  runMutationGuardAfterSuccess,
+  serializeDocument,
+  validateMutationGuard,
+  withDocumentsContextErrors
+} from "../_shared.js";
+import {
+  attachDocumentsOperationMetadata,
+  buildDocumentsCommandRuntimeContext,
+  resolveDocumentsCommandBus
+} from "../_commands.js";
+const capabilitiesSchema = z.object({
+  canView: z.boolean(),
+  canComment: z.boolean(),
+  canEdit: z.boolean(),
+  canShare: z.boolean(),
+  canDelete: z.boolean(),
+  canCreate: z.boolean(),
+  canManageTemplates: z.boolean(),
+  canArchive: z.boolean(),
+  canDuplicate: z.boolean()
+});
+const detailResponseSchema = z.object({
+  id: z.string().uuid(),
+  title: z.string(),
+  folderId: z.string().uuid().nullable(),
+  ownerUserId: z.string().uuid(),
+  createdByUserId: z.string().uuid(),
+  isActive: z.boolean(),
+  archivedAt: z.string().nullable(),
+  isFavorite: z.boolean(),
+  isWatching: z.boolean(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  tier: z.enum(["owner", "editor", "commenter", "viewer"]),
+  canShare: z.boolean(),
+  capabilities: capabilitiesSchema
+});
+const mutationResponseSchema = z.object({
+  id: z.string().uuid(),
+  updatedAt: z.string()
+});
+const deleteResponseSchema = z.object({
+  ok: z.boolean(),
+  id: z.string().uuid(),
+  updatedAt: z.string()
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["documents.view"] },
+  PUT: { requireAuth: true, requireFeatures: ["documents.edit"] },
+  DELETE: { requireAuth: true, requireFeatures: ["documents.delete"] }
+};
+async function resolveId(context) {
+  const params = await context.params;
+  return params.id;
+}
+async function GET(request, context) {
+  try {
+    const id = await resolveId(context);
+    const ctx = await resolveDocumentsContext(request, ["documents.view"]);
+    const projection = await resolveDocumentCapabilityProjection(ctx, id);
+    if (!projection.relationshipTier || !projection.capabilities.canView) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const document = await loadScopedDocument(ctx, id);
+    const archivedAt = document.archivedAt?.toISOString() ?? null;
+    const capabilities = deriveDocumentCapabilities({
+      relationshipTier: projection.relationshipTier,
+      managerOverride: hasDocumentsFeature(ctx.auth, "documents.manage"),
+      archived: archivedAt !== null,
+      userFeatures: ctx.auth.features
+    });
+    const isFavorite = await isDocumentFavorite(
+      ctx.em,
+      {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: resolveActorUserId(ctx.auth)
+      },
+      id
+    );
+    const isWatching = await isDocumentWatched(
+      ctx.em,
+      {
+        tenantId: ctx.tenantId,
+        organizationId: ctx.organizationId,
+        userId: resolveActorUserId(ctx.auth)
+      },
+      id
+    );
+    return NextResponse.json({
+      ...serializeDocument(document),
+      archivedAt,
+      isFavorite,
+      isWatching,
+      tier: projection.relationshipTier,
+      canShare: capabilities.canShare,
+      capabilities
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.detail");
+  }
+}
+async function PUT(request, context) {
+  try {
+    const id = await resolveId(context);
+    const ctx = await resolveDocumentsContext(request, ["documents.edit"]);
+    const projection = await resolveDocumentCapabilityProjection(ctx, id);
+    if (!projection.capabilities.canEdit) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    await assertDocumentNotArchived(ctx, id);
+    const body = await readBody(request);
+    const input = documentUpdateSchema.parse({ ...body, id });
+    const guardResult = await validateMutationGuard(ctx, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: id,
+      operation: "update",
+      mutationPayload: input,
+      mutationPayloadSchema: documentUpdateSchema
+    });
+    const commandInput = {
+      ...input,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId
+    };
+    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute("documents.document.update", {
+      input: commandInput,
+      ctx: buildDocumentsCommandRuntimeContext(ctx)
+    });
+    await runMutationGuardAfterSuccess(ctx, guardResult, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: id,
+      operation: "update"
+    });
+    const response = NextResponse.json({ id: result.id, updatedAt: result.updatedAt });
+    return attachDocumentsOperationMetadata(response, logEntry, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: result.id
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.update");
+  }
+}
+async function DELETE(request, context) {
+  try {
+    const id = await resolveId(context);
+    const ctx = await resolveDocumentsContext(request, ["documents.delete"]);
+    const projection = await resolveDocumentCapabilityProjection(ctx, id);
+    if (!projection.capabilities.canDelete) {
+      throw new CrudHttpError(403, { error: "Forbidden" });
+    }
+    const guardResult = await validateMutationGuard(ctx, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: id,
+      operation: "delete"
+    });
+    const commandInput = {
+      id,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId
+    };
+    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute("documents.document.delete", {
+      input: commandInput,
+      ctx: buildDocumentsCommandRuntimeContext(ctx)
+    });
+    await runMutationGuardAfterSuccess(ctx, guardResult, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: id,
+      operation: "delete"
+    });
+    const response = NextResponse.json({ ok: true, id: result.id, updatedAt: result.updatedAt });
+    return attachDocumentsOperationMetadata(response, logEntry, {
+      resourceKind: DOCUMENTS_ENTITY_IDS.document,
+      resourceId: result.id
+    });
+  } catch (error) {
+    return handleDocumentsRouteError(error, "documents.delete");
+  }
+}
+const openApi = withDocumentsContextErrors({
+  tag: "Documents",
+  summary: "Document detail",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Get document metadata",
+      responses: [{ status: 200, description: "Document metadata", schema: detailResponseSchema }],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Not found", schema: routeErrorSchema }
+      ]
+    },
+    PUT: {
+      summary: "Update document metadata",
+      requestBody: { contentType: "application/json", schema: documentUpdateSchema },
+      responses: [{ status: 200, description: "Document updated", schema: mutationResponseSchema }],
+      errors: [
+        { status: 400, description: "Validation failed", schema: routeErrorSchema },
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 409, description: "Optimistic lock conflict", schema: routeErrorSchema },
+        { status: 413, description: "Request body exceeds the safe resource bound", schema: routeErrorSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Delete document",
+      description: "Transactionally releases every document-owned attachment row and its quota usage, soft-deletes the document record, then runs reference-checked provider cleanup after commit. Because attachment bytes cannot be restored, this operation is intentionally not undoable.",
+      responses: [{ status: 200, description: "Document deleted", schema: deleteResponseSchema }],
+      errors: [
+        { status: 401, description: "Unauthorized", schema: routeErrorSchema },
+        { status: 403, description: "Forbidden", schema: routeErrorSchema },
+        { status: 404, description: "Not found", schema: routeErrorSchema },
+        { status: 409, description: "Optimistic lock conflict", schema: routeErrorSchema }
+      ]
+    }
+  }
+});
+var route_default = { GET, PUT, DELETE };
+export {
+  DELETE,
+  GET,
+  PUT,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/documents/api/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/documents/api/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { documentUpdateSchema } from '../../data/validators'\nimport { DOCUMENTS_ENTITY_IDS } from '../../lib/constants'\nimport { deriveDocumentCapabilities } from '../../lib/capabilities'\nimport { isDocumentFavorite } from '../../lib/favorites'\nimport { isDocumentWatched } from '../../lib/watchers'\nimport {\n  assertDocumentNotArchived,\n  handleDocumentsRouteError,\n  hasDocumentsFeature,\n  loadScopedDocument,\n  readBody,\n  resolveActorUserId,\n  resolveDocumentCapabilityProjection,\n  resolveDocumentsContext,\n  routeErrorSchema,\n  runMutationGuardAfterSuccess,\n  serializeDocument,\n  validateMutationGuard,\n  withDocumentsContextErrors,\n} from '../_shared'\nimport {\n  attachDocumentsOperationMetadata,\n  buildDocumentsCommandRuntimeContext,\n  resolveDocumentsCommandBus,\n} from '../_commands'\nimport type {\n  DocumentDeleteCommandInput,\n  DocumentUpdateCommandInput,\n} from '../../commands/document-crud'\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nconst capabilitiesSchema = z.object({\n  canView: z.boolean(),\n  canComment: z.boolean(),\n  canEdit: z.boolean(),\n  canShare: z.boolean(),\n  canDelete: z.boolean(),\n  canCreate: z.boolean(),\n  canManageTemplates: z.boolean(),\n  canArchive: z.boolean(),\n  canDuplicate: z.boolean(),\n})\n\nconst detailResponseSchema = z.object({\n  id: z.string().uuid(),\n  title: z.string(),\n  folderId: z.string().uuid().nullable(),\n  ownerUserId: z.string().uuid(),\n  createdByUserId: z.string().uuid(),\n  isActive: z.boolean(),\n  archivedAt: z.string().nullable(),\n  isFavorite: z.boolean(),\n  isWatching: z.boolean(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n  tier: z.enum(['owner', 'editor', 'commenter', 'viewer']),\n  canShare: z.boolean(),\n  capabilities: capabilitiesSchema,\n})\n\nconst mutationResponseSchema = z.object({\n  id: z.string().uuid(),\n  updatedAt: z.string(),\n})\n\nconst deleteResponseSchema = z.object({\n  ok: z.boolean(),\n  id: z.string().uuid(),\n  updatedAt: z.string(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['documents.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['documents.edit'] },\n  DELETE: { requireAuth: true, requireFeatures: ['documents.delete'] },\n}\n\nasync function resolveId(context: RouteContext): Promise<string> {\n  const params = await context.params\n  return params.id\n}\n\nexport async function GET(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const id = await resolveId(context)\n    const ctx = await resolveDocumentsContext(request, ['documents.view'])\n    const projection = await resolveDocumentCapabilityProjection(ctx, id)\n    if (!projection.relationshipTier || !projection.capabilities.canView) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    const document = await loadScopedDocument(ctx, id)\n    const archivedAt = document.archivedAt?.toISOString() ?? null\n    const capabilities = deriveDocumentCapabilities({\n      relationshipTier: projection.relationshipTier,\n      managerOverride: hasDocumentsFeature(ctx.auth, 'documents.manage'),\n      archived: archivedAt !== null,\n      userFeatures: ctx.auth.features,\n    })\n    const isFavorite = await isDocumentFavorite(\n      ctx.em,\n      {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: resolveActorUserId(ctx.auth),\n      },\n      id,\n    )\n    const isWatching = await isDocumentWatched(\n      ctx.em,\n      {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: resolveActorUserId(ctx.auth),\n      },\n      id,\n    )\n    return NextResponse.json({\n      ...serializeDocument(document),\n      archivedAt,\n      isFavorite,\n      isWatching,\n      tier: projection.relationshipTier,\n      canShare: capabilities.canShare,\n      capabilities,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.detail')\n  }\n}\n\nexport async function PUT(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const id = await resolveId(context)\n    const ctx = await resolveDocumentsContext(request, ['documents.edit'])\n    const projection = await resolveDocumentCapabilityProjection(ctx, id)\n    if (!projection.capabilities.canEdit) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    await assertDocumentNotArchived(ctx, id)\n    const body = await readBody(request)\n    const input = documentUpdateSchema.parse({ ...body, id })\n    const guardResult = await validateMutationGuard(ctx, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: id,\n      operation: 'update',\n      mutationPayload: input,\n      mutationPayloadSchema: documentUpdateSchema,\n    })\n\n    const commandInput: DocumentUpdateCommandInput = {\n      ...input,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    }\n    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute<\n      DocumentUpdateCommandInput,\n      { id: string; updatedAt: string }\n    >('documents.document.update', {\n      input: commandInput,\n      ctx: buildDocumentsCommandRuntimeContext(ctx),\n    })\n    await runMutationGuardAfterSuccess(ctx, guardResult, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: id,\n      operation: 'update',\n    })\n\n    const response = NextResponse.json({ id: result.id, updatedAt: result.updatedAt })\n    return attachDocumentsOperationMetadata(response, logEntry, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: result.id,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.update')\n  }\n}\n\nexport async function DELETE(request: Request, context: RouteContext): Promise<Response> {\n  try {\n    const id = await resolveId(context)\n    const ctx = await resolveDocumentsContext(request, ['documents.delete'])\n    const projection = await resolveDocumentCapabilityProjection(ctx, id)\n    if (!projection.capabilities.canDelete) {\n      throw new CrudHttpError(403, { error: 'Forbidden' })\n    }\n    const guardResult = await validateMutationGuard(ctx, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: id,\n      operation: 'delete',\n    })\n\n    const commandInput: DocumentDeleteCommandInput = {\n      id,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    }\n    const { result, logEntry } = await resolveDocumentsCommandBus(ctx).execute<\n      DocumentDeleteCommandInput,\n      { id: string; updatedAt: string }\n    >('documents.document.delete', {\n      input: commandInput,\n      ctx: buildDocumentsCommandRuntimeContext(ctx),\n    })\n    await runMutationGuardAfterSuccess(ctx, guardResult, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: id,\n      operation: 'delete',\n    })\n\n    const response = NextResponse.json({ ok: true, id: result.id, updatedAt: result.updatedAt })\n    return attachDocumentsOperationMetadata(response, logEntry, {\n      resourceKind: DOCUMENTS_ENTITY_IDS.document,\n      resourceId: result.id,\n    })\n  } catch (error) {\n    return handleDocumentsRouteError(error, 'documents.delete')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = withDocumentsContextErrors({\n  tag: 'Documents',\n  summary: 'Document detail',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'Get document metadata',\n      responses: [{ status: 200, description: 'Document metadata', schema: detailResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Not found', schema: routeErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update document metadata',\n      requestBody: { contentType: 'application/json', schema: documentUpdateSchema },\n      responses: [{ status: 200, description: 'Document updated', schema: mutationResponseSchema }],\n      errors: [\n        { status: 400, description: 'Validation failed', schema: routeErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: routeErrorSchema },\n        { status: 413, description: 'Request body exceeds the safe resource bound', schema: routeErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete document',\n      description: 'Transactionally releases every document-owned attachment row and its quota usage, soft-deletes the document record, then runs reference-checked provider cleanup after commit. Because attachment bytes cannot be restored, this operation is intentionally not undoable.',\n      responses: [{ status: 200, description: 'Document deleted', schema: deleteResponseSchema }],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: routeErrorSchema },\n        { status: 403, description: 'Forbidden', schema: routeErrorSchema },\n        { status: 404, description: 'Not found', schema: routeErrorSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: routeErrorSchema },\n      ],\n    },\n  },\n})\n\nexport default { GET, PUT, DELETE }\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAC3C,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,EAAE,QAAQ;AAAA,EACtB,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,WAAW,EAAE,QAAQ;AAAA,EACrB,WAAW,EAAE,QAAQ;AAAA,EACrB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,YAAY,EAAE,QAAQ;AAAA,EACtB,cAAc,EAAE,QAAQ;AAC1B,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,UAAU,EAAE,QAAQ;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ;AAAA,EACtB,YAAY,EAAE,QAAQ;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,SAAS,UAAU,aAAa,QAAQ,CAAC;AAAA,EACvD,UAAU,EAAE,QAAQ;AAAA,EACpB,cAAc;AAChB,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ;AAAA,EACd,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACrE;AAEA,eAAe,UAAU,SAAwC;AAC/D,QAAM,SAAS,MAAM,QAAQ;AAC7B,SAAO,OAAO;AAChB;AAEA,eAAsB,IAAI,SAAkB,SAA0C;AACpF,MAAI;AACF,UAAM,KAAK,MAAM,UAAU,OAAO;AAClC,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AACrE,UAAM,aAAa,MAAM,oCAAoC,KAAK,EAAE;AACpE,QAAI,CAAC,WAAW,oBAAoB,CAAC,WAAW,aAAa,SAAS;AACpE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,WAAW,MAAM,mBAAmB,KAAK,EAAE;AACjD,UAAM,aAAa,SAAS,YAAY,YAAY,KAAK;AACzD,UAAM,eAAe,2BAA2B;AAAA,MAC9C,kBAAkB,WAAW;AAAA,MAC7B,iBAAiB,oBAAoB,IAAI,MAAM,kBAAkB;AAAA,MACjE,UAAU,eAAe;AAAA,MACzB,cAAc,IAAI,KAAK;AAAA,IACzB,CAAC;AACD,UAAM,aAAa,MAAM;AAAA,MACvB,IAAI;AAAA,MACJ;AAAA,QACE,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,mBAAmB,IAAI,IAAI;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AACA,UAAM,aAAa,MAAM;AAAA,MACvB,IAAI;AAAA,MACJ;AAAA,QACE,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,mBAAmB,IAAI,IAAI;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,GAAG,kBAAkB,QAAQ;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,WAAW;AAAA,MACjB,UAAU,aAAa;AAAA,MACvB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,kBAAkB;AAAA,EAC5D;AACF;AAEA,eAAsB,IAAI,SAAkB,SAA0C;AACpF,MAAI;AACF,UAAM,KAAK,MAAM,UAAU,OAAO;AAClC,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,gBAAgB,CAAC;AACrE,UAAM,aAAa,MAAM,oCAAoC,KAAK,EAAE;AACpE,QAAI,CAAC,WAAW,aAAa,SAAS;AACpC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,0BAA0B,KAAK,EAAE;AACvC,UAAM,OAAO,MAAM,SAAS,OAAO;AACnC,UAAM,QAAQ,qBAAqB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;AACxD,UAAM,cAAc,MAAM,sBAAsB,KAAK;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB,uBAAuB;AAAA,IACzB,CAAC;AAED,UAAM,eAA2C;AAAA,MAC/C,GAAG;AAAA,MACH,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,2BAA2B,GAAG,EAAE,QAGjE,6BAA6B;AAAA,MAC7B,OAAO;AAAA,MACP,KAAK,oCAAoC,GAAG;AAAA,IAC9C,CAAC;AACD,UAAM,6BAA6B,KAAK,aAAa;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,IAAI,WAAW,OAAO,UAAU,CAAC;AACjF,WAAO,iCAAiC,UAAU,UAAU;AAAA,MAC1D,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,kBAAkB;AAAA,EAC5D;AACF;AAEA,eAAsB,OAAO,SAAkB,SAA0C;AACvF,MAAI;AACF,UAAM,KAAK,MAAM,UAAU,OAAO;AAClC,UAAM,MAAM,MAAM,wBAAwB,SAAS,CAAC,kBAAkB,CAAC;AACvE,UAAM,aAAa,MAAM,oCAAoC,KAAK,EAAE;AACpE,QAAI,CAAC,WAAW,aAAa,WAAW;AACtC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,IACrD;AACA,UAAM,cAAc,MAAM,sBAAsB,KAAK;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AAED,UAAM,eAA2C;AAAA,MAC/C;AAAA,MACA,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,2BAA2B,GAAG,EAAE,QAGjE,6BAA6B;AAAA,MAC7B,OAAO;AAAA,MACP,KAAK,oCAAoC,GAAG;AAAA,IAC9C,CAAC;AACD,UAAM,6BAA6B,KAAK,aAAa;AAAA,MACnD,cAAc,qBAAqB;AAAA,MACnC,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,IAAI,OAAO,IAAI,WAAW,OAAO,UAAU,CAAC;AAC3F,WAAO,iCAAiC,UAAU,UAAU;AAAA,MAC1D,cAAc,qBAAqB;AAAA,MACnC,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,0BAA0B,OAAO,kBAAkB;AAAA,EAC5D;AACF;AAEO,MAAM,UAA2B,2BAA2B;AAAA,EACjE,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB,CAAC;AAAA,MAC3F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,MACpE;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,qBAAqB;AAAA,MAC7E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,uBAAuB,CAAC;AAAA,MAC5F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,iBAAiB;AAAA,MACvG;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,qBAAqB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,iBAAiB;AAAA,QACrE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,iBAAiB;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAED,IAAO,gBAAQ,EAAE,KAAK,KAAK,OAAO;",
+  "names": []
+}