/api/brand-studio/run-override

import { readBoundedJsonRequest } from "../../../../lib/bounded-http.mjs";
// Tap-to-swap, hosted.
//
// The report lets a reader say "that is not our primary blue, THIS is" and the
// pick has to survive a reload, or it is a toy. On the panel that write lands
// in a sidecar file beside the run; here it lands on the caller's own pull row
// (see lib/report-api.mjs for why `summary.report_overrides` and not a new
// column, and why it cannot race the queue).
//
// The URL and the request body are the panel's, unchanged, because the client
// making this request is the panel's client — lib/run.ts, byte-identical. What
// differs is that this one demands a bearer token and writes only to a row the
// caller owns.
//
// A CAPTURE IS NEVER MUTATED. `value: null` removes the entry rather than
// writing a "reverted" state, so the original pick is what remains when a
// human pick is withdrawn — the report re-derives from `capture_result` every
// time it renders.
export const runtime = "nodejs";
export const dynamic = "force-dynamic";

import { NextResponse } from "next/server";
import { supabaseConfigFromEnv } from "../../../../lib/supabase-rest.mjs";
import { bearerTokenFromHeader } from "../../../../lib/comprehensive-pull.mjs";
import { mergeOverride, overridesFromRow, readWritablePull, writeOverrides } from "../../../../lib/report-api.mjs";

export async function POST(request) {
  const token = bearerTokenFromHeader(request.headers.get("authorization"));
  let body;
  try { body = await readBoundedJsonRequest(request); }
  catch (error) { return NextResponse.json({ status: "refused", reason: error.code || "invalid_json" }, { status: error.httpStatus || 400 }); }
  const runId = String(body?.run_id || "").trim();
  const config = supabaseConfigFromEnv(process.env);

  const owned = await readWritablePull({ runId, token, config });
  if (!owned.ok) return NextResponse.json(owned.body, { status: owned.http_status });

  const merged = mergeOverride(overridesFromRow(owned.row), body);
  if (!merged.ok) {
    return NextResponse.json({ status: "blocked", reason: merged.reason }, { status: 400 });
  }
  const written = await writeOverrides({
    row: owned.row,
    overrides: merged.overrides,
    config,
    authToken: owned.authToken
  });
  return NextResponse.json(written.body, { status: written.http_status });
}