@nextsparkjs/core 0.1.0-beta.16 → 0.1.0-beta.161

package/dist/lib/api/entity/generic-handler.js

@@ -1,8 +1,8 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, hasRequiredScope, canBypassTeamContext } from "../auth/dual-auth";
-import { resolveEntityFromUrl, validateEntityOperation } from "./resolver";
-import { generateEntitySchemas } from "../../entities/schema-generator";
-import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db";
+import { authenticateRequest, hasRequiredScope, canBypassTeamContext } from "../auth/dual-auth.js";
+import { resolveEntityFromUrl, validateEntityOperation } from "./resolver.js";
+import { generateEntitySchemas } from "../../entities/schema-generator.js";
+import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
 import {
   createApiResponse,
   createApiError,
@@ -16,8 +16,49 @@ import {
   handleEntityMetadataInResponse,
   addCorsHeaders,
   handleCorsPreflightRequest
-} from "../helpers";
-import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../../entities/entity-hooks";
+} from "../helpers.js";
+import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../../entities/entity-hooks.js";
+import { checkPermission } from "../../permissions/check.js";
+import { extractPatternIds } from "../../blocks/pattern-resolver.js";
+import { isPatternReference } from "../../../types/pattern-reference.js";
+import { PatternUsageService } from "../../services/pattern-usage.service.js";
+import { SubscriptionService } from "../../services/subscription.service.js";
+import { UsageService } from "../../services/usage.service.js";
+import { BILLING_REGISTRY } from "@nextsparkjs/registries/billing-registry";
+const HTML_TAG_CHARS_RE = /[<>]/;
+const SAFE_TEXT_FIELDS = /* @__PURE__ */ new Set(["name", "title"]);
+function checkNameFieldXss(entityConfig, validatedData) {
+  for (const field of entityConfig.fields) {
+    if (!SAFE_TEXT_FIELDS.has(field.name)) continue;
+    if (field.type !== "text" && field.type !== "textarea") continue;
+    const value = validatedData[field.name];
+    if (typeof value === "string" && HTML_TAG_CHARS_RE.test(value)) {
+      return field.name;
+    }
+  }
+  return null;
+}
+function filterPublicFields(data, entityConfig, userId) {
+  var _a;
+  const publicFields = (_a = entityConfig.access) == null ? void 0 : _a.publicFields;
+  if (!publicFields || publicFields.length === 0 || userId !== null) {
+    return data;
+  }
+  const allowedSet = new Set(publicFields);
+  const filterItem = (item) => {
+    const filtered = {};
+    for (const key of allowedSet) {
+      if (key in item) {
+        filtered[key] = item[key];
+      }
+    }
+    return filtered;
+  };
+  if (Array.isArray(data)) {
+    return data.map((item) => filterItem(item));
+  }
+  return filterItem(data);
+}
 async function includeTaxonomiesInData(entityConfig, items, userId) {
   var _a, _b, _c;
   if (!((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) || !((_c = (_b = entityConfig.taxonomies) == null ? void 0 : _b.types) == null ? void 0 : _c.length) || items.length === 0) {
@@ -128,12 +169,73 @@ function parseTaxonomyFilterParams(url, entityConfig) {
 function getTableName(entityConfig) {
   return entityConfig.tableName || entityConfig.slug;
 }
+async function filterOrphanedPatternReferences(blocks, userId) {
+  if (!Array.isArray(blocks) || blocks.length === 0) return blocks;
+  const patternIds = extractPatternIds(blocks);
+  if (patternIds.length === 0) return blocks;
+  const existingIds = await PatternUsageService.getExistingPatternIds(patternIds, userId);
+  if (existingIds.size === patternIds.length) return blocks;
+  const filtered = blocks.filter((block) => {
+    if (isPatternReference(block)) {
+      const exists = existingIds.has(block.ref);
+      if (!exists) {
+        console.info(`[generic-handler] Filtering orphaned PatternReference: ${block.ref}`);
+      }
+      return exists;
+    }
+    return true;
+  });
+  return filtered;
+}
 function getTeamIdFromRequest(request) {
   return request.headers.get("x-team-id");
 }
 function isBuilderRequest(request) {
   return request.headers.get("x-builder-source") === "true";
 }
+async function resolveOwnershipFilter(entityConfig, userId, teamId, isBypass, authType) {
+  var _a;
+  const ownershipFilter = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter;
+  if (!ownershipFilter) return { applies: false };
+  if (isBypass || authType === "api-key") return { applies: false };
+  const memberRow = await queryOneWithRLS(
+    'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
+    [teamId, userId],
+    userId
+  );
+  if (!memberRow) return { applies: false };
+  const userRole = memberRow.role;
+  if (!ownershipFilter.roles.includes(userRole)) {
+    return { applies: false };
+  }
+  const { table, userField, valueField } = ownershipFilter.linkedBy;
+  const linkedRow = await queryOneWithRLS(
+    `SELECT "${valueField}" FROM "${table}" WHERE "${userField}" = $1 AND "teamId" = $2 AND "deletedAt" IS NULL`,
+    [userId, teamId],
+    userId
+  );
+  const filterValue = linkedRow ? linkedRow[valueField] ?? null : null;
+  return { applies: true, field: ownershipFilter.field, value: filterValue };
+}
+async function checkSessionPermission(authResult, entitySlug, action, teamId, request) {
+  var _a;
+  if (authResult.type !== "session" || !((_a = authResult.user) == null ? void 0 : _a.id)) return null;
+  const permission = `${entitySlug}.${action}`;
+  try {
+    const allowed = await checkPermission(authResult.user.id, teamId, permission);
+    if (!allowed) {
+      const response = createApiError(
+        `Permission denied: insufficient permissions for ${entitySlug}.${action}`,
+        403,
+        void 0,
+        "PERMISSION_DENIED"
+      );
+      return addCorsHeaders(response, request);
+    }
+  } catch {
+  }
+  return null;
+}
 async function validateTeamMembership(userId, teamId) {
   try {
     console.log("[GenericHandler] Validating team membership:", { userId, teamId, teamIdLength: teamId == null ? void 0 : teamId.length });
@@ -154,7 +256,7 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
   const canBypass = await canBypassTeamContext(authResult, request);
   if (canBypass) {
     console.log("[GenericHandler] Admin bypass active:", { userId, teamId: teamId || "cross-team" });
-    return { valid: true, teamId };
+    return { valid: true, teamId, isBypass: true };
   }
   if (!teamId) {
     const response = createApiError(
@@ -175,25 +277,26 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
     );
     return { valid: false, error: await addCorsHeaders(response) };
   }
-  return { valid: true, teamId };
+  return { valid: true, teamId, isBypass: false };
 }
 async function handleGenericList(request) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "list")) {
       const response2 = createApiError("List operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
     let teamId = null;
+    let isBypass = false;
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
-      console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} list`);
+      teamId = request.headers.get("x-team-id") ?? null;
     } else if (!authResult.success) {
       return NextResponse.json(
         { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
@@ -205,7 +308,7 @@ async function handleGenericList(request) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -213,6 +316,7 @@ async function handleGenericList(request) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
     }
     const pagination = parsePaginationParams(request);
     const metaParams = parseMetaParams(request);
@@ -252,10 +356,13 @@ async function handleGenericList(request) {
         return `t.${columnName}`;
       }).join(", ");
     } else {
-      const systemFields = ["id", "createdAt", "updatedAt"];
+      const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
       if ((_b = entityConfig.builder) == null ? void 0 : _b.enabled) {
         systemFields.push("blocks");
       }
+      if ((_c = entityConfig.table) == null ? void 0 : _c.softDelete) {
+        systemFields.push("deletedAt", "deletedBy");
+      }
       const configFields = entityConfig.fields.map((field) => {
         const columnName = /[A-Z]/.test(field.name) ? `"${field.name}"` : field.name;
         return `t.${columnName}`;
@@ -265,6 +372,9 @@ async function handleGenericList(request) {
         return `t.${columnName}`;
       });
       fields = [...systemFieldsFormatted, ...configFields].join(", ");
+      if (entityConfig.slug === "patterns") {
+        fields += ', COALESCE(pu.usage_count, 0)::int as "usageCount"';
+      }
     }
     let query;
     let queryParams;
@@ -273,32 +383,54 @@ async function handleGenericList(request) {
     const fromDate = url.searchParams.get("from");
     const toDate = url.searchParams.get("to");
     const dateFieldName = url.searchParams.get("dateField");
-    const isPublicEntity = ((_c = entityConfig.access) == null ? void 0 : _c.public) === true;
-    const requestingPublishedOnly = (_d = customFilters["status"]) == null ? void 0 : _d.includes("published");
+    const isPublicEntity = ((_d = entityConfig.access) == null ? void 0 : _d.public) === true;
+    const requestingPublishedOnly = (_e = customFilters["status"]) == null ? void 0 : _e.includes("published");
     const skipUserFilter = isPublicEntity && requestingPublishedOnly;
     if (skipUserFilter && process.env.NODE_ENV === "development") {
       console.log(`[GenericHandler] Public access mode: skipping userId filter for ${entityConfig.slug} (status=published)`);
     }
     const tableName = getTableName(entityConfig);
     const taxonomyFilter = parseTaxonomyFilterParams(url, entityConfig);
+    let ownershipFilter = { applies: false };
+    if (userId && teamId) {
+      ownershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        userId,
+        teamId,
+        isBypass,
+        authResult.type
+      );
+    }
+    if (ownershipFilter.applies && ownershipFilter.value === null) {
+      const paginationMeta2 = createPaginationMeta(pagination.page, pagination.limit, 0);
+      const response2 = createApiResponse([], paginationMeta2);
+      return addCorsHeaders(response2, request);
+    }
     if (specificIds && specificIds.length > 0) {
       const idPlaceholders = specificIds.map(() => `$${paramIndex++}`).join(", ");
       query = `SELECT ${fields} FROM "${tableName}" t WHERE t.id IN (${idPlaceholders})`;
       queryParams = [...specificIds];
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         query += ` AND t."teamId" = $${paramIndex++}`;
         queryParams.push(teamId);
       }
-      if (userId && !((_e = entityConfig.access) == null ? void 0 : _e.shared) && !skipUserFilter) {
+      if (userId && !((_f = entityConfig.access) == null ? void 0 : _f.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        query += ` AND t."${ownershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_g = entityConfig.table) == null ? void 0 : _g.softDelete) && !isBypass) {
+        query += ` AND t."deletedAt" IS NULL`;
+      }
     } else if (fieldsParam && distinctParam) {
       const fieldName = fieldsParam;
       const parentId = url.searchParams.get("parentId");
       query = `SELECT ${fields} FROM "${tableName}" t WHERE 1=1`;
       queryParams = [];
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         query += ` AND t."teamId" = $${paramIndex++}`;
         queryParams.push(teamId);
       }
@@ -306,24 +438,38 @@ async function handleGenericList(request) {
         query += ` AND t."parentId" = $${paramIndex++}`;
         queryParams.push(parentId);
       }
-      if (userId && !((_f = entityConfig.access) == null ? void 0 : _f.shared) && !skipUserFilter) {
+      if (userId && !((_h = entityConfig.access) == null ? void 0 : _h.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        query += ` AND t."${ownershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_i = entityConfig.table) == null ? void 0 : _i.softDelete) && !isBypass) {
+        query += ` AND t."deletedAt" IS NULL`;
+      }
       query += ` ORDER BY "${fieldName}" ASC LIMIT $${paramIndex++}`;
       queryParams.push(pagination.limit);
     } else {
       const whereConditions = [];
       queryParams = [];
       paramIndex = 1;
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         whereConditions.push(`t."teamId" = $${paramIndex++}`);
         queryParams.push(teamId);
       }
-      if (userId && !((_g = entityConfig.access) == null ? void 0 : _g.shared) && !skipUserFilter) {
+      if (userId && !((_j = entityConfig.access) == null ? void 0 : _j.shared) && !skipUserFilter && !isBypass) {
         whereConditions.push(`t."userId" = $${paramIndex++}`);
         queryParams.push(userId);
       }
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        whereConditions.push(`t."${ownershipFilter.field}" = $${paramIndex++}`);
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_k = entityConfig.table) == null ? void 0 : _k.softDelete) && !isBypass) {
+        whereConditions.push(`t."deletedAt" IS NULL`);
+      }
       if (searchParam && searchParam.trim() !== "") {
         const searchTerm = searchParam.trim();
         const hasName = entityConfig.fields.some((f) => f.name === "name");
@@ -397,107 +543,42 @@ async function handleGenericList(request) {
         queryParams.push(taxonomyFilter.taxonomyId);
       }
       const whereClause = whereConditions.length > 0 ? `WHERE ${whereConditions.join(" AND ")}` : "";
+      let joinClause = "";
+      if (entityConfig.slug === "patterns") {
+        joinClause = `
+          LEFT JOIN (
+            SELECT "patternId", COUNT(*) as usage_count
+            FROM pattern_usages
+            GROUP BY "patternId"
+          ) pu ON t.id = pu."patternId"
+        `;
+      }
+      const sortByParam = url.searchParams.get("sortBy");
+      const sortOrderParam = ((_l = url.searchParams.get("sortOrder")) == null ? void 0 : _l.toUpperCase()) === "ASC" ? "ASC" : "DESC";
+      let orderByClause = 't."createdAt" DESC';
+      if (sortByParam) {
+        const baseFields = ["id", "createdAt", "updatedAt", "teamId"];
+        const isValidField = entityConfig.fields.some((f) => f.name === sortByParam) || baseFields.includes(sortByParam);
+        if (isValidField) {
+          orderByClause = `t."${sortByParam}" ${sortOrderParam}`;
+        }
+      }
       query = `
-        SELECT ${fields}
+        SELECT ${fields}, COUNT(*) OVER() as total_count
         FROM "${tableName}" t
+        ${joinClause}
         ${whereClause}
-        ORDER BY t."createdAt" DESC
+        ORDER BY ${orderByClause}
         LIMIT $${paramIndex++} OFFSET $${paramIndex++}
       `;
       queryParams.push(pagination.limit, pagination.offset);
     }
-    const data = await queryWithRLS(query, queryParams, userId);
-    let totalResult;
-    const countWhereConditions = [];
-    const countParams = [];
-    let countParamIndex = 1;
-    if (teamId && !skipUserFilter) {
-      countWhereConditions.push(`"teamId" = $${countParamIndex++}`);
-      countParams.push(teamId);
-    }
-    if (userId && !((_h = entityConfig.access) == null ? void 0 : _h.shared) && !skipUserFilter) {
-      countWhereConditions.push(`"userId" = $${countParamIndex++}`);
-      countParams.push(userId);
-    }
-    if (searchParam && searchParam.trim() !== "") {
-      const searchTerm = searchParam.trim();
-      const hasName = entityConfig.fields.some((f) => f.name === "name");
-      const hasTitle = entityConfig.fields.some((f) => f.name === "title");
-      const hasSlug = entityConfig.fields.some((f) => f.name === "slug");
-      const hasContent = entityConfig.fields.some((f) => f.name === "content");
-      if (hasName || hasTitle || hasSlug || hasContent) {
-        const searchConditions = [];
-        if (hasName) {
-          searchConditions.push(`name ILIKE $${countParamIndex}`);
-        }
-        if (hasTitle) {
-          searchConditions.push(`title ILIKE $${countParamIndex}`);
-        }
-        if (hasSlug) {
-          searchConditions.push(`slug ILIKE $${countParamIndex}`);
-        }
-        if (hasContent) {
-          searchConditions.push(`content ILIKE $${countParamIndex}`);
-        }
-        countWhereConditions.push(`(${searchConditions.join(" OR ")})`);
-        countParams.push(`%${searchTerm}%`);
-        countParamIndex++;
-      }
-    }
-    if (dateFieldName && (fromDate || toDate)) {
-      const field = entityConfig.fields.find((f) => f.name === dateFieldName);
-      if (field && (field.type === "datetime" || field.type === "date")) {
-        if (fromDate) {
-          countWhereConditions.push(`"${dateFieldName}" >= $${countParamIndex++}`);
-          countParams.push(fromDate);
-        }
-        if (toDate) {
-          countWhereConditions.push(`"${dateFieldName}" <= $${countParamIndex++}`);
-          countParams.push(toDate);
-        }
-      }
-    }
-    Object.entries(customFilters).forEach(([key, values]) => {
-      const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && values.length > 0) {
-        const columnName = `"${key}"`;
-        if (field.type === "relation-multi" || key === "socialPlatformId") {
-          const orConditions = values.map(() => {
-            const condition = `${columnName}::jsonb @> $${countParamIndex++}::jsonb`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(JSON.stringify([value]));
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        } else {
-          const orConditions = values.map(() => {
-            const condition = `${columnName} = $${countParamIndex++}`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(value);
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        }
-      }
+    const rawData = await queryWithRLS(query, queryParams, userId);
+    const total = rawData.length > 0 ? Number(rawData[0].total_count) || 0 : 0;
+    const data = rawData.map((row) => {
+      const { total_count, ...rest } = row;
+      return rest;
     });
-    if (taxonomyFilter == null ? void 0 : taxonomyFilter.taxonomyId) {
-      countWhereConditions.push(`EXISTS (
-        SELECT 1 FROM entity_taxonomy_relations etr
-        WHERE etr."entityId" = id::text
-          AND etr."entityType" = '${entityConfig.slug}'
-          AND etr."taxonomyId" = $${countParamIndex++}
-      )`);
-      countParams.push(taxonomyFilter.taxonomyId);
-    }
-    const countWhereClause = countWhereConditions.length > 0 ? `WHERE ${countWhereConditions.join(" AND ")}` : "";
-    totalResult = await queryWithRLS(
-      `SELECT COUNT(*) as count FROM "${tableName}" ${countWhereClause}`,
-      countParams,
-      userId
-    );
-    const total = ((_i = totalResult[0]) == null ? void 0 : _i.count) || 0;
     const paginationMeta = createPaginationMeta(pagination.page, pagination.limit, total);
     let dataWithMeta = data;
     if (metaParams.includeMetadata && userId) {
@@ -520,32 +601,33 @@ async function handleGenericList(request) {
       );
     }
     let dataWithTaxonomies = dataWithChild;
-    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
+    if ((_m = entityConfig.taxonomies) == null ? void 0 : _m.enabled) {
       dataWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         dataWithChild,
         userId
       );
     }
-    const response = createApiResponse(dataWithTaxonomies, paginationMeta);
-    return addCorsHeaders(response);
+    const finalData = filterPublicFields(dataWithTaxonomies, entityConfig, userId);
+    const response = createApiResponse(finalData, paginationMeta);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic list handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericCreate(request) {
-  var _a, _b, _c, _d, _e, _f, _g;
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "create")) {
       const response2 = createApiError("Create operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -559,14 +641,14 @@ async function handleGenericCreate(request) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const rawUserId = entityData.userId;
@@ -580,16 +662,33 @@ async function handleGenericCreate(request) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
+    const xssField = checkNameFieldXss(entityConfig, validatedData);
+    if (xssField) {
+      const xssResponse = createApiError(
+        `Field '${xssField}' must not contain HTML markup`,
+        400,
+        void 0,
+        "INVALID_FIELD_VALUE"
+      );
+      return addCorsHeaders(xssResponse, request);
+    }
     const idStrategy = ((_a = entityConfig.idStrategy) == null ? void 0 : _a.type) || "uuid";
     let insertFields;
     let placeholders;
     let values;
     let paramCount;
     const isSharedEntity = ((_b = entityConfig.access) == null ? void 0 : _b.shared) === true;
-    const userIdToUse = isSharedEntity && rawUserId ? rawUserId : authResult.user.id;
+    let userIdToUse = authResult.user.id;
+    if (isSharedEntity && Object.prototype.hasOwnProperty.call(entityData, "userId")) {
+      if (rawUserId === null) {
+        userIdToUse = null;
+      } else if (typeof rawUserId === "string" && rawUserId.trim() !== "") {
+        userIdToUse = rawUserId;
+      }
+    }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
       return teamValidation.error;
@@ -597,8 +696,10 @@ async function handleGenericCreate(request) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for create operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
+    const permDenied = await checkSessionPermission(authResult, entityConfig.slug, "create", teamId, request);
+    if (permDenied) return permDenied;
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
       placeholders = ["$1", "$2"];
@@ -614,7 +715,8 @@ async function handleGenericCreate(request) {
     const builderRequest = isBuilderRequest(request);
     const entityHasBuilder = ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in validatedData) {
-      const blocksValue = validatedData.blocks;
+      let blocksValue = validatedData.blocks;
+      blocksValue = await filterOrphanedPatternReferences(blocksValue, authResult.user.id);
       insertFields.push('"blocks"');
       placeholders.push(`$${paramCount++}::jsonb`);
       values.push(JSON.stringify(blocksValue));
@@ -624,7 +726,7 @@ async function handleGenericCreate(request) {
       var _a2, _b2;
       if (key === "userId" || key === "teamId") return;
       const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly) && field.display.showInForm !== false) {
+      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly)) {
         const columnName = `"${key}"`;
         insertFields.push(columnName);
         if (field.type === "relation") {
@@ -644,7 +746,9 @@ async function handleGenericCreate(request) {
           values.push(relationId);
         } else if (field.type === "relation-multi") {
           placeholders.push(`$${paramCount++}::jsonb`);
-          values.push(value);
+          values.push(
+            typeof value === "string" ? value : JSON.stringify(Array.isArray(value) ? value : [])
+          );
         } else if (field.type === "tags") {
           placeholders.push(`$${paramCount++}::jsonb`);
           values.push(JSON.stringify(Array.isArray(value) ? value : []));
@@ -670,14 +774,45 @@ async function handleGenericCreate(request) {
         }
       }
     });
+    const createAction = `${entityConfig.slug}.create`;
+    const limitSlug = (_f = (_e = (_d = BILLING_REGISTRY) == null ? void 0 : _d.actionMappings) == null ? void 0 : _e.limits) == null ? void 0 : _f[createAction];
+    if (limitSlug) {
+      const actionResult = await SubscriptionService.canPerformAction(
+        authResult.user.id,
+        teamId,
+        createAction
+      );
+      if (!actionResult.allowed) {
+        const statusCode = actionResult.reason === "quota_exceeded" ? 429 : 403;
+        const response2 = createApiError(
+          actionResult.message || `Quota exceeded for ${entityConfig.slug}`,
+          statusCode,
+          void 0,
+          actionResult.reason === "quota_exceeded" ? "QUOTA_EXCEEDED" : "FEATURE_NOT_IN_PLAN"
+        );
+        return addCorsHeaders(response2, request);
+      }
+    }
     const insertQuery = `
       INSERT INTO "${tableName}" (${insertFields.join(", ")})
       VALUES (${placeholders.join(", ")}) RETURNING *
     `;
     const insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
-    const createdEntityId = String((_d = insertResult.rows[0]) == null ? void 0 : _d.id);
-    const systemFields = ["id", "userId", "createdAt", "updatedAt"];
-    if ((_e = entityConfig.builder) == null ? void 0 : _e.enabled) {
+    const createdEntityId = String((_g = insertResult.rows[0]) == null ? void 0 : _g.id);
+    if (limitSlug) {
+      UsageService.track({
+        teamId,
+        userId: authResult.user.id,
+        limitSlug,
+        delta: 1,
+        action: createAction,
+        resourceType: entityConfig.slug,
+        resourceId: createdEntityId
+      }).catch(() => {
+      });
+    }
+    const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
+    if ((_h = entityConfig.builder) == null ? void 0 : _h.enabled) {
       systemFields.push("blocks");
     }
     const configFields = entityConfig.fields.map((field) => {
@@ -696,7 +831,7 @@ async function handleGenericCreate(request) {
     `;
     const createdItems = await queryWithRLS(selectQuery, [createdEntityId], authResult.user.id);
     const createdItem = createdItems[0];
-    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
+    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
       await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, false);
     }
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
@@ -709,7 +844,7 @@ async function handleGenericCreate(request) {
       );
     }
     let responseItem = createdItem;
-    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
+    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [createdItem],
@@ -729,29 +864,41 @@ async function handleGenericCreate(request) {
       console.error(`[generic-handler] Error in afterEntityCreate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic create handler:", error);
+    if (error && typeof error === "object" && "code" in error && error.code === "23505") {
+      const detail = "detail" in error ? error.detail : void 0;
+      const constraint = "constraint" in error ? error.constraint : void 0;
+      const response2 = createApiError(
+        "A record with this value already exists",
+        409,
+        { constraint, detail },
+        "UNIQUE_CONSTRAINT_VIOLATION"
+      );
+      return addCorsHeaders(response2, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericRead(request, { params }) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e, _f;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "read")) {
       const response2 = createApiError("Read operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     let userId = null;
     let teamId = null;
+    let isBypass = false;
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
       console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} read`);
     } else if (!authResult.success) {
@@ -765,7 +912,7 @@ async function handleGenericRead(request, { params }) {
       }
       if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
         const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
@@ -773,13 +920,17 @@ async function handleGenericRead(request, { params }) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
     }
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
-    const systemFields = ["id", "createdAt", "updatedAt"];
+    const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
     if ((_b = entityConfig.builder) == null ? void 0 : _b.enabled) {
       systemFields.push("blocks");
     }
+    if ((_c = entityConfig.table) == null ? void 0 : _c.softDelete) {
+      systemFields.push("deletedAt", "deletedBy");
+    }
     const configFields = entityConfig.fields.map((field) => {
       const columnName = /[A-Z]/.test(field.name) ? `"${field.name}"` : field.name;
       return `t.${columnName}`;
@@ -802,14 +953,34 @@ async function handleGenericRead(request, { params }) {
       query += ` AND t."teamId" = $${paramIndex++}`;
       queryParams.push(teamId);
     }
-    if (userId && !((_c = entityConfig.access) == null ? void 0 : _c.shared)) {
+    if (userId && !((_d = entityConfig.access) == null ? void 0 : _d.shared) && !isBypass) {
       query += ` AND t."userId" = $${paramIndex++}`;
       queryParams.push(userId);
     }
+    if (userId && teamId) {
+      const readOwnershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        userId,
+        teamId,
+        isBypass,
+        authResult.type
+      );
+      if (readOwnershipFilter.applies) {
+        if (readOwnershipFilter.value === null) {
+          const response2 = createApiError("Item not found", 404);
+          return addCorsHeaders(response2, request);
+        }
+        query += ` AND t."${readOwnershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(readOwnershipFilter.value);
+      }
+    }
+    if (((_e = entityConfig.table) == null ? void 0 : _e.softDelete) && !isBypass) {
+      query += ` AND t."deletedAt" IS NULL`;
+    }
     const items = await queryWithRLS(query, queryParams, userId);
     if (!items[0]) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const item = items[0];
     const metaParams = parseMetaParams(request);
@@ -836,7 +1007,7 @@ async function handleGenericRead(request, { params }) {
       itemWithChild = itemsWithChild[0] || itemWithMeta;
     }
     let itemWithTaxonomies = itemWithChild;
-    if ((_d = entityConfig.taxonomies) == null ? void 0 : _d.enabled) {
+    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [itemWithChild],
@@ -844,26 +1015,27 @@ async function handleGenericRead(request, { params }) {
       );
       itemWithTaxonomies = itemsWithTaxonomies[0] || itemWithChild;
     }
-    const response = createApiResponse(itemWithTaxonomies);
-    return addCorsHeaders(response);
+    const finalItem = filterPublicFields(itemWithTaxonomies, entityConfig, userId);
+    const response = createApiResponse(finalItem);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic read handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericUpdate(request, { params }) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c, _d, _e, _f;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "update")) {
       const response2 = createApiError("Update operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -877,7 +1049,7 @@ async function handleGenericUpdate(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -886,17 +1058,43 @@ async function handleGenericUpdate(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for update operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
+    const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "update", teamId, request);
+    if (permDenied) return permDenied;
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const entityConfig = resolution.entityConfig;
+    const fieldGuards = (_b = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter) == null ? void 0 : _b.fieldGuards;
+    if (fieldGuards && fieldGuards.length > 0 && authResult.type === "session") {
+      const guardMemberRow = await queryOneWithRLS(
+        'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
+        [teamId, authResult.user.id],
+        authResult.user.id
+      );
+      if (guardMemberRow) {
+        for (const guard of fieldGuards) {
+          if (guard.roles.includes(guardMemberRow.role)) {
+            const forbidden = guard.denyFields.filter((f) => f in entityData);
+            if (forbidden.length > 0) {
+              const response2 = createApiError(
+                `Role '${guardMemberRow.role}' is not allowed to modify field(s): ${forbidden.join(", ")}`,
+                403,
+                void 0,
+                "FIELD_MODIFICATION_DENIED"
+              );
+              return addCorsHeaders(response2, request);
+            }
+          }
+        }
+      }
+    }
     const tableName = getTableName(entityConfig);
     const schemas = generateEntitySchemas(entityConfig);
     const validation = schemas.update.safeParse(entityData);
@@ -906,17 +1104,29 @@ async function handleGenericUpdate(request, { params }) {
         errors: validation.error.issues
       });
       const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const validatedData = validation.data;
+    const updateXssField = checkNameFieldXss(entityConfig, validatedData);
+    if (updateXssField) {
+      const updateXssResponse = createApiError(
+        `Field '${updateXssField}' must not contain HTML markup`,
+        400,
+        void 0,
+        "INVALID_FIELD_VALUE"
+      );
+      return addCorsHeaders(updateXssResponse, request);
+    }
     const updates = [];
     const values = [];
     let paramCount = 1;
     const builderRequest = isBuilderRequest(request);
-    const entityHasBuilder = ((_a = entityConfig.builder) == null ? void 0 : _a.enabled) === true;
+    const entityHasBuilder = ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
+      let blocksData = entityData.blocks;
+      blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
       updates.push(`"blocks" = $${paramCount++}::jsonb`);
-      values.push(JSON.stringify(entityData.blocks));
+      values.push(JSON.stringify(blocksData));
     }
     const originalKeys = Object.keys(entityData);
     const fieldsToUpdate = Object.entries(validatedData).filter(([key]) => originalKeys.includes(key));
@@ -924,7 +1134,7 @@ async function handleGenericUpdate(request, { params }) {
       var _a2, _b2;
       if (key === "blocks") return;
       const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly) && field.display.showInForm !== false) {
+      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly)) {
         const columnName = `"${key}"`;
         if (field.type === "relation") {
           let relationId = null;
@@ -943,7 +1153,9 @@ async function handleGenericUpdate(request, { params }) {
           values.push(relationId);
         } else if (field.type === "relation-multi") {
           updates.push(`${columnName} = $${paramCount++}::jsonb`);
-          values.push(value);
+          values.push(
+            typeof value === "string" ? value : JSON.stringify(Array.isArray(value) ? value : [])
+          );
         } else if (field.type === "tags") {
           updates.push(`${columnName} = $${paramCount++}::jsonb`);
           values.push(JSON.stringify(Array.isArray(value) ? value : []));
@@ -972,7 +1184,7 @@ async function handleGenericUpdate(request, { params }) {
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (updates.length === 0 && !metadataWasProvided) {
       const response2 = createApiError("No fields to update", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (updates.length > 0) {
       updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -985,10 +1197,25 @@ async function handleGenericUpdate(request, { params }) {
         whereConditions.push(`"teamId" = $${paramCount++}`);
         values.push(teamId);
       }
-      if (!((_b = entityConfig.access) == null ? void 0 : _b.shared)) {
+      if (!((_d = entityConfig.access) == null ? void 0 : _d.shared)) {
         whereConditions.push(`"userId" = $${paramCount++}`);
         values.push(authResult.user.id);
       }
+      const updateOwnershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        authResult.user.id,
+        teamId,
+        teamValidation.isBypass,
+        authResult.type
+      );
+      if (updateOwnershipFilter.applies) {
+        if (updateOwnershipFilter.value === null) {
+          const response2 = createApiError("Item not found", 404);
+          return addCorsHeaders(response2, request);
+        }
+        whereConditions.push(`"${updateOwnershipFilter.field}" = $${paramCount++}`);
+        values.push(updateOwnershipFilter.value);
+      }
       const updateQuery = `
         UPDATE "${tableName}"
         SET ${updates.join(", ")}
@@ -998,7 +1225,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result.rows[0];
     } else {
@@ -1011,11 +1238,11 @@ async function handleGenericUpdate(request, { params }) {
       const result = await queryWithRLS(selectQuery, selectValues, authResult.user.id);
       if (!result || result.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result[0];
     }
-    if ((_c = entityConfig.taxonomies) == null ? void 0 : _c.enabled) {
+    if ((_e = entityConfig.taxonomies) == null ? void 0 : _e.enabled) {
       await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
     }
     if (metadataWasProvided) {
@@ -1027,7 +1254,7 @@ async function handleGenericUpdate(request, { params }) {
       );
     }
     let responseItem = updatedItem;
-    if ((_d = entityConfig.taxonomies) == null ? void 0 : _d.enabled) {
+    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [updatedItem],
@@ -1047,25 +1274,36 @@ async function handleGenericUpdate(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityUpdate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic update handler:", error);
+    if (error && typeof error === "object" && "code" in error && error.code === "23505") {
+      const detail = "detail" in error ? error.detail : void 0;
+      const constraint = "constraint" in error ? error.constraint : void 0;
+      const response2 = createApiError(
+        "A record with this value already exists",
+        409,
+        { constraint, detail },
+        "UNIQUE_CONSTRAINT_VIOLATION"
+      );
+      return addCorsHeaders(response2, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericDelete(request, { params }) {
-  var _a;
+  var _a, _b, _c, _d, _e;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "delete")) {
       const response2 = createApiError("Delete operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const authResult = await authenticateRequest(request);
     if (!authResult.success) {
@@ -1079,7 +1317,7 @@ async function handleGenericDelete(request, { params }) {
     }
     if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
       const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
     if (!teamValidation.valid) {
@@ -1088,8 +1326,10 @@ async function handleGenericDelete(request, { params }) {
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for delete operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
+    const permDenied = await checkSessionPermission(authResult, resolution.entityConfig.slug, "delete", teamId, request);
+    if (permDenied) return permDenied;
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
     const whereConditions = ["id = $1"];
@@ -1103,31 +1343,68 @@ async function handleGenericDelete(request, { params }) {
       whereConditions.push(`"userId" = $${paramIndex++}`);
       deleteParams.push(authResult.user.id);
     }
-    const deleteQuery = `
-      DELETE FROM "${tableName}"
-      WHERE ${whereConditions.join(" AND ")}
-      RETURNING id
-    `;
+    let deleteQuery;
+    if ((_b = entityConfig.table) == null ? void 0 : _b.softDelete) {
+      whereConditions.push(`"deletedAt" IS NULL`);
+      deleteQuery = `
+        UPDATE "${tableName}"
+        SET "deletedAt" = NOW(), "deletedBy" = $${paramIndex++}
+        WHERE ${whereConditions.join(" AND ")}
+        RETURNING id
+      `;
+      deleteParams.push(authResult.user.id);
+    } else {
+      deleteQuery = `
+        DELETE FROM "${tableName}"
+        WHERE ${whereConditions.join(" AND ")}
+        RETURNING id
+      `;
+    }
     const result = await mutateWithRLS(deleteQuery, deleteParams, authResult.user.id);
     if (!result.rows || result.rows.length === 0) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     try {
       await afterEntityDelete(entityConfig.slug, id, authResult.user.id);
     } catch (hookError) {
       console.error(`[generic-handler] Error in afterEntityDelete hook for ${entityConfig.slug}:`, hookError);
     }
+    const deleteAction = `${entityConfig.slug}.create`;
+    const deleteLimitSlug = (_e = (_d = (_c = BILLING_REGISTRY) == null ? void 0 : _c.actionMappings) == null ? void 0 : _d.limits) == null ? void 0 : _e[deleteAction];
+    if (deleteLimitSlug) {
+      UsageService.track({
+        teamId,
+        userId: authResult.user.id,
+        limitSlug: deleteLimitSlug,
+        delta: -1,
+        action: `${entityConfig.slug}.delete`,
+        resourceType: entityConfig.slug,
+        resourceId: id
+      }).catch(() => {
+      });
+    }
     const response = createApiResponse({ success: true, id });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic delete handler:", error);
+    if (error && typeof error === "object" && "code" in error && error.code === "23503") {
+      const detail = "detail" in error ? error.detail : void 0;
+      const constraint = "constraint" in error ? error.constraint : void 0;
+      const response2 = createApiError(
+        detail || "Cannot delete: this record is referenced by other records",
+        409,
+        { constraint },
+        "FOREIGN_KEY_VIOLATION"
+      );
+      return addCorsHeaders(response2, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
-async function handleGenericOptions() {
-  return handleCorsPreflightRequest();
+async function handleGenericOptions(request) {
+  return handleCorsPreflightRequest(request);
 }
 async function handleDistinctJsonbField(entityConfig, fieldName, url, userId) {
   var _a;