In `@packages/rest-typings/src/v1/omnichannel.ts`:
- Around line 4446-4457: Update the regex character classes to move the hyphen
to the end so they read `[0-9a-zA-Z_-]` for both customFieldId and
customFieldData.field to avoid creating an unintended range; also reconcile the
nullable mismatch by either removing `nullable: true` from the `customFieldId`
schema or updating the type guard that references `customFieldId` (the check
near the type guard around line ~4502) to accept `string | null` so schema and
runtime types match.

In `@apps/meteor/app/api/server/router.ts`:
- Around line 44-49: The APIActionContext construction should defensively
default potentially-undefined context entries; update the code that builds
APIActionContext (the object with requestIp, urlParams, queryParams, bodyParams,
request) to use c.get('bodyParams') ?? {} and c.get('queryParams') ?? {} so
bodyParams and queryParams are always objects even if c.get(...) returns
undefined, keeping the existing fields (e.g., requestIp: c.get('remoteAddress')
and urlParams: req.param()) unchanged.

In `@apps/meteor/app/api/server/middlewares/logger.ts`:
- Around line 23-25: The logger middleware currently uses redact: ['password']
which won't match nested fields inside the request body; update the redact
configuration to target the nested payload key (use redact:
['payload.password']) in the logger/middleware configuration so that any
password inside the payload object is properly redacted; locate the redact
property in the logger middleware file
(apps/meteor/app/api/server/middlewares/logger.ts) and replace the array entry
'password' with 'payload.password'.

In `@packages/http-router/src/Router.ts`:
- Around line 165-168: parseBodyParams currently returns form entries directly
from request.raw.clone().formData() (in Router.ts) so payload fields sent as
application/x-www-form-urlencoded remain JSON strings; update the code in
parseBodyParams to detect a "payload" entry, attempt to JSON.parse(payload) and
merge/replace its parsed object into the returned params (e.g., const parsed =
JSON.parse(payload) and return { ...otherParams, ...parsed }), and ensure
parsing is wrapped in try/catch so malformed JSON falls back to the original
string; this change will satisfy the incoming-integrations test that sends
payload=JSON.stringify(payload) and allow processWebhookMessage to receive
unwrapped fields like msg/text.

In `@apps/meteor/server/lib/logger/logPayloads.ts`:
- Around line 26-39: getRestPayload currently only catches errors from
request.raw.clone().json()'s .json() call but not from request.raw.clone()
itself, which can throw if the body was already consumed; modify the async
branch in getRestPayload to wrap the entire clone+json sequence in a try/catch
(surround request.raw.clone().json() with try) and on any error return {
payload: null } (or { payload: '[multipart/form-data]' } earlier), ensuring
clone failures are handled and logging remains best‑effort.

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/rest-typings/src/v1/omnichannel.ts">

<violation number="1" location="packages/rest-typings/src/v1/omnichannel.ts:4503">
P2: The type for `customFieldId` no longer matches the schema: the schema allows `null` and omission, but the type now requires a key and disallows `null`. This will reject valid inputs in typing/compile-time usage. Consider making the property optional and allowing `null` to align with the schema.</violation>
</file>

In `@apps/meteor/app/livechat/server/api/v1/customField.ts`:
- Around line 114-123: The validation order is inverted: the regex check for
customFieldId should run before querying the DB so format errors return
immediately; update the block that uses customFieldId (the conditional
containing LivechatCustomField.findOneById and the /^[0-9a-zA-Z-_]+$/ test) to
first test the regex and return API.v1.failure('Invalid custom field name...')
on failure, then call LivechatCustomField.findOneById(customFieldId) and return
API.v1.failure('Custom Field Not found') if that lookup returns null.