@nextsparkjs/core 0.1.0-beta.19 → 0.1.0-beta.191

package/dist/lib/api/entity/generic-handler.js

@@ -1,8 +1,8 @@
 import { NextResponse } from "next/server";
-import { authenticateRequest, hasRequiredScope, canBypassTeamContext } from "../auth/dual-auth";
-import { resolveEntityFromUrl, validateEntityOperation } from "./resolver";
-import { generateEntitySchemas } from "../../entities/schema-generator";
-import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db";
+import { authenticateRequest, createAuthFailureResponse, canBypassTeamContext } from "../auth/dual-auth.js";
+import { resolveEntityFromUrl, validateEntityOperation } from "./resolver.js";
+import { generateEntitySchemas } from "../../entities/schema-generator.js";
+import { queryWithRLS, mutateWithRLS, queryOneWithRLS } from "../../db.js";
 import {
   createApiResponse,
   createApiError,
@@ -16,8 +16,50 @@ import {
   handleEntityMetadataInResponse,
   addCorsHeaders,
   handleCorsPreflightRequest
-} from "../helpers";
-import { afterEntityCreate, afterEntityUpdate, afterEntityDelete } from "../../entities/entity-hooks";
+} from "../helpers.js";
+import { beforeEntityCreate, afterEntityCreate, beforeEntityUpdate, afterEntityUpdate, beforeEntityDelete, afterEntityDelete, beforeEntityRead, afterEntityRead } from "../../entities/entity-hooks.js";
+import { logGenericHandlerUsage } from "./audit-log.js";
+import { checkPermission } from "../../permissions/check.js";
+import { extractPatternIds } from "../../blocks/pattern-resolver.js";
+import { isPatternReference } from "../../../types/pattern-reference.js";
+import { PatternUsageService } from "../../services/pattern-usage.service.js";
+import { SubscriptionService } from "../../services/subscription.service.js";
+import { UsageService } from "../../services/usage.service.js";
+import { BILLING_REGISTRY } from "@nextsparkjs/registries/billing-registry";
+const HTML_TAG_CHARS_RE = /[<>]/;
+const SAFE_TEXT_FIELDS = /* @__PURE__ */ new Set(["name", "title"]);
+function checkNameFieldXss(entityConfig, validatedData) {
+  for (const field of entityConfig.fields) {
+    if (!SAFE_TEXT_FIELDS.has(field.name)) continue;
+    if (field.type !== "text" && field.type !== "textarea") continue;
+    const value = validatedData[field.name];
+    if (typeof value === "string" && HTML_TAG_CHARS_RE.test(value)) {
+      return field.name;
+    }
+  }
+  return null;
+}
+function filterPublicFields(data, entityConfig, userId) {
+  var _a;
+  const publicFields = (_a = entityConfig.access) == null ? void 0 : _a.publicFields;
+  if (!publicFields || publicFields.length === 0 || userId !== null) {
+    return data;
+  }
+  const allowedSet = new Set(publicFields);
+  const filterItem = (item) => {
+    const filtered = {};
+    for (const key of allowedSet) {
+      if (key in item) {
+        filtered[key] = item[key];
+      }
+    }
+    return filtered;
+  };
+  if (Array.isArray(data)) {
+    return data.map((item) => filterItem(item));
+  }
+  return filterItem(data);
+}
 async function includeTaxonomiesInData(entityConfig, items, userId) {
   var _a, _b, _c;
   if (!((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) || !((_c = (_b = entityConfig.taxonomies) == null ? void 0 : _b.types) == null ? void 0 : _c.length) || items.length === 0) {
@@ -128,12 +170,181 @@ function parseTaxonomyFilterParams(url, entityConfig) {
 function getTableName(entityConfig) {
   return entityConfig.tableName || entityConfig.slug;
 }
+function isEntityField(entityConfig, fieldName) {
+  return entityConfig.fields.some((field) => field.name === fieldName);
+}
+const LIST_RESERVED_PARAMS = /* @__PURE__ */ new Set([
+  "page",
+  "limit",
+  "fields",
+  "distinct",
+  "ids",
+  "parentId",
+  "search",
+  "sortBy",
+  "sortOrder",
+  "sort",
+  "order",
+  "child",
+  "meta",
+  "metas",
+  "includeMeta",
+  "userId",
+  "from",
+  "to",
+  "dateField",
+  "userFiltered"
+]);
+const TAXONOMY_FILTER_PARAMS = ["categoryId", "taxonomyId", "taxonomyType"];
+const SEARCHABLE_FIELDS = ["name", "title", "slug", "content"];
+const SORTABLE_BASE_FIELDS = ["id", "createdAt", "updatedAt", "teamId"];
+const BARE_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function omitHandlerManagedKeys(entityConfig, data) {
+  var _a;
+  const managed = /* @__PURE__ */ new Set(["userId", "teamId"]);
+  if ((_a = entityConfig.taxonomies) == null ? void 0 : _a.enabled) {
+    for (const taxonomyType of entityConfig.taxonomies.types ?? []) {
+      managed.add(taxonomyType.field);
+    }
+  }
+  return Object.fromEntries(Object.entries(data).filter(([key]) => !managed.has(key)));
+}
+function validationErrorMessage(issues) {
+  const unknownKeys = issues.filter((issue) => issue.code === "unrecognized_keys").flatMap((issue) => issue.keys ?? []);
+  return unknownKeys.length > 0 ? `Unknown field(s): ${unknownKeys.join(", ")}` : "Validation error";
+}
+function asPgError(error) {
+  if (error && typeof error === "object" && "code" in error && typeof error.code === "string") {
+    return error;
+  }
+  return null;
+}
+function mapConstraintViolation(error, operation) {
+  const pgError = asPgError(error);
+  if (!pgError) return null;
+  const { constraint, detail, table } = pgError;
+  switch (pgError.code) {
+    case "23505":
+      return createApiError(
+        "A record with this value already exists",
+        409,
+        { constraint, detail },
+        "UNIQUE_CONSTRAINT_VIOLATION"
+      );
+    case "23514":
+      return createApiError(
+        constraint ? `Value rejected by check constraint "${constraint}"` : "Value rejected by a database check constraint",
+        422,
+        { constraint, table },
+        "CHECK_CONSTRAINT_VIOLATION"
+      );
+    case "23503":
+      if (operation === "delete") {
+        return createApiError(
+          detail || "Cannot delete: this record is referenced by other records",
+          409,
+          { constraint },
+          "FOREIGN_KEY_VIOLATION"
+        );
+      }
+      return createApiError(
+        detail ? `Referenced record does not exist: ${detail}` : "Referenced record does not exist",
+        422,
+        { constraint, detail },
+        "FOREIGN_KEY_VIOLATION"
+      );
+    default:
+      return null;
+  }
+}
+function hookRejectionStatus(error) {
+  if (error && typeof error === "object") {
+    const candidate = error.status ?? error.statusCode;
+    if (typeof candidate === "number" && candidate >= 400 && candidate < 500) {
+      return candidate;
+    }
+  }
+  return 400;
+}
+async function filterOrphanedPatternReferences(blocks, userId) {
+  if (!Array.isArray(blocks) || blocks.length === 0) return blocks;
+  const patternIds = extractPatternIds(blocks);
+  if (patternIds.length === 0) return blocks;
+  const existingIds = await PatternUsageService.getExistingPatternIds(patternIds, userId);
+  if (existingIds.size === patternIds.length) return blocks;
+  const filtered = blocks.filter((block) => {
+    if (isPatternReference(block)) {
+      const exists = existingIds.has(block.ref);
+      if (!exists) {
+        console.info(`[generic-handler] Filtering orphaned PatternReference: ${block.ref}`);
+      }
+      return exists;
+    }
+    return true;
+  });
+  return filtered;
+}
 function getTeamIdFromRequest(request) {
   return request.headers.get("x-team-id");
 }
 function isBuilderRequest(request) {
   return request.headers.get("x-builder-source") === "true";
 }
+async function resolveOwnershipFilter(entityConfig, userId, teamId, isBypass) {
+  var _a;
+  const ownershipFilter = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter;
+  if (!ownershipFilter) return { applies: false };
+  if (isBypass) return { applies: false };
+  const memberRow = await queryOneWithRLS(
+    'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
+    [teamId, userId],
+    userId
+  );
+  if (!memberRow) return { applies: false };
+  const userRole = memberRow.role;
+  if (!ownershipFilter.roles.includes(userRole)) {
+    return { applies: false };
+  }
+  if (!ownershipFilter.linkedBy) {
+    return { applies: true, field: ownershipFilter.field, value: userId };
+  }
+  const { table, userField, valueField, softDelete } = ownershipFilter.linkedBy;
+  const softDeleteClause = softDelete === false ? "" : ' AND "deletedAt" IS NULL';
+  const linkedRow = await queryOneWithRLS(
+    `SELECT "${valueField}" FROM "${table}" WHERE "${userField}" = $1 AND "teamId" = $2${softDeleteClause}`,
+    [userId, teamId],
+    userId
+  );
+  const filterValue = linkedRow ? linkedRow[valueField] ?? null : null;
+  return { applies: true, field: ownershipFilter.field, value: filterValue };
+}
+async function checkAuthPermission(authResult, entitySlug, action, teamId, request) {
+  var _a;
+  if (!((_a = authResult.user) == null ? void 0 : _a.id)) return null;
+  const permission = `${entitySlug}.${action}`;
+  try {
+    const allowed = await checkPermission(authResult.user.id, teamId, permission);
+    if (!allowed) {
+      const response = createApiError(
+        `Permission denied: insufficient permissions for ${entitySlug}.${action}`,
+        403,
+        void 0,
+        "PERMISSION_DENIED"
+      );
+      return addCorsHeaders(response, request);
+    }
+  } catch (error) {
+    console.error(`[GenericHandler] Permission check errored for ${entitySlug}.${action}:`, error);
+    const response = createApiError(
+      `Permission check failed for ${entitySlug}.${action}`,
+      500,
+      void 0,
+      "PERMISSION_CHECK_FAILED"
+    );
+    return addCorsHeaders(response, request);
+  }
+  return null;
+}
 async function validateTeamMembership(userId, teamId) {
   try {
     console.log("[GenericHandler] Validating team membership:", { userId, teamId, teamIdLength: teamId == null ? void 0 : teamId.length });
@@ -154,7 +365,7 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
   const canBypass = await canBypassTeamContext(authResult, request);
   if (canBypass) {
     console.log("[GenericHandler] Admin bypass active:", { userId, teamId: teamId || "cross-team" });
-    return { valid: true, teamId };
+    return { valid: true, teamId, isBypass: true };
   }
   if (!teamId) {
     const response = createApiError(
@@ -175,44 +386,64 @@ async function validateTeamContextWithBypass(request, authResult, userId) {
     );
     return { valid: false, error: await addCorsHeaders(response) };
   }
-  return { valid: true, teamId };
+  return { valid: true, teamId, isBypass: false };
+}
+async function runWithAuditLog(request, run) {
+  const startedAt = Date.now();
+  const audit = { auth: null };
+  let statusCode = 500;
+  try {
+    const response = await run(audit);
+    statusCode = response.status;
+    return response;
+  } finally {
+    logGenericHandlerUsage(audit.auth, request, statusCode, Date.now() - startedAt).catch((error) => {
+      console.error("[generic-handler:audit] unexpected audit failure:", error);
+    });
+  }
 }
 async function handleGenericList(request) {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+  return runWithAuditLog(request, (audit) => handleGenericListImpl(request, audit));
+}
+async function handleGenericListImpl(request, audit) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "list")) {
       const response2 = createApiError("List operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
-    const authResult = await authenticateRequest(request);
+    const authResult = await authenticateRequest(request, { requiredScope: `${resolution.entityConfig.slug}:read` });
+    audit.auth = authResult;
     let userId = null;
     let teamId = null;
+    let isBypass = false;
+    if (!authResult.success && authResult.type === "api-key") {
+      return addCorsHeaders(createAuthFailureResponse(authResult), request);
+    }
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
-      console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} list`);
+      teamId = request.headers.get("x-team-id") ?? null;
     } else if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     } else {
       if (authResult.rateLimitResponse) {
         return authResult.rateLimitResponse;
       }
-      if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
-        const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
-      }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
-      if (!teamValidation.valid) {
+      if (teamValidation.valid === false) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
+      if (!isBypass && teamId) {
+        const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "list", teamId, request);
+        if (permDenied) return permDenied;
+      }
     }
     const pagination = parsePaginationParams(request);
     const metaParams = parseMetaParams(request);
@@ -221,10 +452,9 @@ async function handleGenericList(request) {
     const distinctParam = url.searchParams.get("distinct") === "true";
     const idsFromParams = url.searchParams.getAll("ids");
     const specificIds = idsFromParams.length > 0 ? idsFromParams.flatMap((param) => param.split(",").map((id) => id.trim())).filter(Boolean) : null;
-    const knownParams = /* @__PURE__ */ new Set(["page", "limit", "fields", "distinct", "ids", "parentId", "search", "sortBy", "sortOrder", "child", "meta", "from", "to", "dateField"]);
     const customFilters = {};
     url.searchParams.forEach((value, key) => {
-      if (!knownParams.has(key) && value) {
+      if (!LIST_RESERVED_PARAMS.has(key) && value) {
         if (!customFilters[key]) {
           customFilters[key] = [];
         }
@@ -233,9 +463,59 @@ async function handleGenericList(request) {
       }
     });
     const entityConfig = resolution.entityConfig;
+    const shapedQuery = await beforeEntityRead(entityConfig.slug, { ...customFilters }, userId ?? void 0);
+    for (const [key, value] of Object.entries(shapedQuery)) {
+      customFilters[key] = Array.isArray(value) ? value.map(String) : [String(value)];
+    }
+    const taxonomyFilterParams = ((_b = entityConfig.taxonomies) == null ? void 0 : _b.enabled) ? TAXONOMY_FILTER_PARAMS : [];
+    const invalidFilterKeys = Object.keys(customFilters).filter(
+      (key) => !isEntityField(entityConfig, key) && !taxonomyFilterParams.includes(key)
+    );
+    if (invalidFilterKeys.length > 0) {
+      const response2 = createApiError(
+        `Unknown filter parameter(s) for ${entityConfig.slug}: ${invalidFilterKeys.join(", ")}`,
+        400,
+        {
+          invalidKeys: invalidFilterKeys,
+          allowedKeys: [...entityConfig.fields.map((f) => f.name), ...taxonomyFilterParams]
+        },
+        "INVALID_FILTER"
+      );
+      return addCorsHeaders(response2, request);
+    }
+    const searchParam = url.searchParams.get("search");
+    const searchableFields = SEARCHABLE_FIELDS.filter((name) => isEntityField(entityConfig, name));
+    if (searchParam && searchParam.trim() !== "" && searchableFields.length === 0) {
+      const response2 = createApiError(
+        `Entity ${entityConfig.slug} has no searchable field (${SEARCHABLE_FIELDS.join(", ")}); the search parameter is not supported`,
+        400,
+        { searchableFields: SEARCHABLE_FIELDS },
+        "SEARCH_NOT_SUPPORTED"
+      );
+      return addCorsHeaders(response2, request);
+    }
+    const sortByParam = url.searchParams.get("sortBy") || url.searchParams.get("sort");
+    if (sortByParam && !isEntityField(entityConfig, sortByParam) && !SORTABLE_BASE_FIELDS.includes(sortByParam)) {
+      const response2 = createApiError(
+        `Invalid sortBy field for ${entityConfig.slug}: ${sortByParam}`,
+        400,
+        { allowedFields: [...SORTABLE_BASE_FIELDS, ...entityConfig.fields.map((f) => f.name)] },
+        "INVALID_SORT_FIELD"
+      );
+      return addCorsHeaders(response2, request);
+    }
     let fields;
     if (fieldsParam && distinctParam) {
       const fieldName = fieldsParam;
+      if (!isEntityField(entityConfig, fieldName)) {
+        const response2 = createApiError(
+          `Invalid field for distinct query: ${fieldName}`,
+          400,
+          void 0,
+          "INVALID_FIELD"
+        );
+        return addCorsHeaders(response2, request);
+      }
       const isJsonbField = fieldName === "contentLanguages" || fieldName === "brandValues" || fieldName === "hashtags";
       if (isJsonbField) {
         return handleDistinctJsonbField(entityConfig, fieldName, url, userId);
@@ -244,18 +524,19 @@ async function handleGenericList(request) {
       }
     } else if (fieldsParam) {
       const requestedFields = fieldsParam.split(",").map((f) => f.trim());
-      const validFields = requestedFields.filter(
-        (fieldName) => entityConfig.fields.some((field) => field.name === fieldName)
-      );
+      const validFields = requestedFields.filter((fieldName) => isEntityField(entityConfig, fieldName));
       fields = ["id", ...validFields].map((fieldName) => {
         const columnName = /[A-Z]/.test(fieldName) ? `"${fieldName}"` : fieldName;
         return `t.${columnName}`;
       }).join(", ");
     } else {
-      const systemFields = ["id", "createdAt", "updatedAt"];
-      if ((_b = entityConfig.builder) == null ? void 0 : _b.enabled) {
+      const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
+      if ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) {
         systemFields.push("blocks");
       }
+      if ((_d = entityConfig.table) == null ? void 0 : _d.softDelete) {
+        systemFields.push("deletedAt", "deletedBy");
+      }
       const configFields = entityConfig.fields.map((field) => {
         const columnName = /[A-Z]/.test(field.name) ? `"${field.name}"` : field.name;
         return `t.${columnName}`;
@@ -265,40 +546,67 @@ async function handleGenericList(request) {
         return `t.${columnName}`;
       });
       fields = [...systemFieldsFormatted, ...configFields].join(", ");
+      if (entityConfig.slug === "patterns") {
+        fields += ', COALESCE(pu.usage_count, 0)::int as "usageCount"';
+      }
     }
     let query;
     let queryParams;
     let paramIndex = 1;
-    const searchParam = url.searchParams.get("search");
     const fromDate = url.searchParams.get("from");
     const toDate = url.searchParams.get("to");
     const dateFieldName = url.searchParams.get("dateField");
-    const isPublicEntity = ((_c = entityConfig.access) == null ? void 0 : _c.public) === true;
-    const requestingPublishedOnly = (_d = customFilters["status"]) == null ? void 0 : _d.includes("published");
+    const isPublicEntity = ((_e = entityConfig.access) == null ? void 0 : _e.public) === true;
+    const requestingPublishedOnly = (_f = customFilters["status"]) == null ? void 0 : _f.includes("published");
     const skipUserFilter = isPublicEntity && requestingPublishedOnly;
     if (skipUserFilter && process.env.NODE_ENV === "development") {
       console.log(`[GenericHandler] Public access mode: skipping userId filter for ${entityConfig.slug} (status=published)`);
     }
+    const forcePublishedOnly = isPublicEntity && userId === null && entityConfig.fields.some((f) => f.name === "status");
     const tableName = getTableName(entityConfig);
     const taxonomyFilter = parseTaxonomyFilterParams(url, entityConfig);
+    let ownershipFilter = { applies: false };
+    if (userId && teamId) {
+      ownershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        userId,
+        teamId,
+        isBypass
+      );
+    }
+    if (ownershipFilter.applies && ownershipFilter.value === null) {
+      const paginationMeta2 = createPaginationMeta(pagination.page, pagination.limit, 0);
+      const response2 = createApiResponse([], paginationMeta2);
+      return addCorsHeaders(response2, request);
+    }
     if (specificIds && specificIds.length > 0) {
       const idPlaceholders = specificIds.map(() => `$${paramIndex++}`).join(", ");
       query = `SELECT ${fields} FROM "${tableName}" t WHERE t.id IN (${idPlaceholders})`;
       queryParams = [...specificIds];
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         query += ` AND t."teamId" = $${paramIndex++}`;
         queryParams.push(teamId);
       }
-      if (userId && !((_e = entityConfig.access) == null ? void 0 : _e.shared) && !skipUserFilter) {
+      if (forcePublishedOnly) {
+        query += ` AND t."status" = 'published'`;
+      }
+      if (userId && !((_g = entityConfig.access) == null ? void 0 : _g.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        query += ` AND t."${ownershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_h = entityConfig.table) == null ? void 0 : _h.softDelete) && !isBypass) {
+        query += ` AND t."deletedAt" IS NULL`;
+      }
     } else if (fieldsParam && distinctParam) {
       const fieldName = fieldsParam;
       const parentId = url.searchParams.get("parentId");
       query = `SELECT ${fields} FROM "${tableName}" t WHERE 1=1`;
       queryParams = [];
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         query += ` AND t."teamId" = $${paramIndex++}`;
         queryParams.push(teamId);
       }
@@ -306,48 +614,50 @@ async function handleGenericList(request) {
         query += ` AND t."parentId" = $${paramIndex++}`;
         queryParams.push(parentId);
       }
-      if (userId && !((_f = entityConfig.access) == null ? void 0 : _f.shared) && !skipUserFilter) {
+      if (userId && !((_i = entityConfig.access) == null ? void 0 : _i.shared) && !skipUserFilter && !isBypass) {
         query += ` AND t."userId" = $${paramIndex++}`;
         queryParams.push(userId);
       }
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        query += ` AND t."${ownershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_j = entityConfig.table) == null ? void 0 : _j.softDelete) && !isBypass) {
+        query += ` AND t."deletedAt" IS NULL`;
+      }
+      if (forcePublishedOnly) {
+        query += ` AND t."status" = 'published'`;
+      }
       query += ` ORDER BY "${fieldName}" ASC LIMIT $${paramIndex++}`;
       queryParams.push(pagination.limit);
     } else {
       const whereConditions = [];
       queryParams = [];
       paramIndex = 1;
-      if (teamId && !skipUserFilter) {
+      if (teamId) {
         whereConditions.push(`t."teamId" = $${paramIndex++}`);
         queryParams.push(teamId);
       }
-      if (userId && !((_g = entityConfig.access) == null ? void 0 : _g.shared) && !skipUserFilter) {
+      if (userId && !((_k = entityConfig.access) == null ? void 0 : _k.shared) && !skipUserFilter && !isBypass) {
         whereConditions.push(`t."userId" = $${paramIndex++}`);
         queryParams.push(userId);
       }
-      if (searchParam && searchParam.trim() !== "") {
+      if (ownershipFilter.applies && ownershipFilter.value !== null) {
+        whereConditions.push(`t."${ownershipFilter.field}" = $${paramIndex++}`);
+        queryParams.push(ownershipFilter.value);
+      }
+      if (((_l = entityConfig.table) == null ? void 0 : _l.softDelete) && !isBypass) {
+        whereConditions.push(`t."deletedAt" IS NULL`);
+      }
+      if (forcePublishedOnly) {
+        whereConditions.push(`t."status" = 'published'`);
+      }
+      if (searchParam && searchParam.trim() !== "" && searchableFields.length > 0) {
         const searchTerm = searchParam.trim();
-        const hasName = entityConfig.fields.some((f) => f.name === "name");
-        const hasTitle = entityConfig.fields.some((f) => f.name === "title");
-        const hasSlug = entityConfig.fields.some((f) => f.name === "slug");
-        const hasContent = entityConfig.fields.some((f) => f.name === "content");
-        if (hasName || hasTitle || hasSlug || hasContent) {
-          const searchConditions = [];
-          if (hasName) {
-            searchConditions.push(`t.name ILIKE $${paramIndex}`);
-          }
-          if (hasTitle) {
-            searchConditions.push(`t.title ILIKE $${paramIndex}`);
-          }
-          if (hasSlug) {
-            searchConditions.push(`t.slug ILIKE $${paramIndex}`);
-          }
-          if (hasContent) {
-            searchConditions.push(`t.content ILIKE $${paramIndex}`);
-          }
-          whereConditions.push(`(${searchConditions.join(" OR ")})`);
-          queryParams.push(`%${searchTerm}%`);
-          paramIndex++;
-        }
+        const searchConditions = searchableFields.map((name) => `t.${name} ILIKE $${paramIndex}`);
+        whereConditions.push(`(${searchConditions.join(" OR ")})`);
+        queryParams.push(`%${searchTerm}%`);
+        paramIndex++;
       }
       if (dateFieldName && (fromDate || toDate)) {
         const field = entityConfig.fields.find((f) => f.name === dateFieldName);
@@ -375,6 +685,18 @@ async function handleGenericList(request) {
               queryParams.push(JSON.stringify([value]));
             });
             whereConditions.push(`(${orConditions.join(" OR ")})`);
+          } else if (field.type === "date" || field.type === "datetime") {
+            const orConditions = values.map((value) => {
+              if (BARE_DATE_RE.test(value)) {
+                const lower = paramIndex++;
+                const upper = paramIndex++;
+                queryParams.push(value, value);
+                return `(t.${columnName} >= $${lower}::date AND t.${columnName} < $${upper}::date + 1)`;
+              }
+              queryParams.push(value);
+              return `t.${columnName} = $${paramIndex++}`;
+            });
+            whereConditions.push(`(${orConditions.join(" OR ")})`);
           } else {
             const orConditions = values.map(() => {
               const condition = `t.${columnName} = $${paramIndex++}`;
@@ -397,107 +719,35 @@ async function handleGenericList(request) {
         queryParams.push(taxonomyFilter.taxonomyId);
       }
       const whereClause = whereConditions.length > 0 ? `WHERE ${whereConditions.join(" AND ")}` : "";
+      let joinClause = "";
+      if (entityConfig.slug === "patterns") {
+        joinClause = `
+          LEFT JOIN (
+            SELECT "patternId", COUNT(*) as usage_count
+            FROM pattern_usages
+            GROUP BY "patternId"
+          ) pu ON t.id = pu."patternId"
+        `;
+      }
+      const sortOrderRaw = url.searchParams.get("sortOrder") || url.searchParams.get("order");
+      const sortOrderParam = (sortOrderRaw == null ? void 0 : sortOrderRaw.toUpperCase()) === "ASC" ? "ASC" : "DESC";
+      const orderByClause = sortByParam ? `t."${sortByParam}" ${sortOrderParam}` : 't."createdAt" DESC';
       query = `
-        SELECT ${fields}
+        SELECT ${fields}, COUNT(*) OVER() as total_count
         FROM "${tableName}" t
+        ${joinClause}
         ${whereClause}
-        ORDER BY t."createdAt" DESC
+        ORDER BY ${orderByClause}
         LIMIT $${paramIndex++} OFFSET $${paramIndex++}
       `;
       queryParams.push(pagination.limit, pagination.offset);
     }
-    const data = await queryWithRLS(query, queryParams, userId);
-    let totalResult;
-    const countWhereConditions = [];
-    const countParams = [];
-    let countParamIndex = 1;
-    if (teamId && !skipUserFilter) {
-      countWhereConditions.push(`"teamId" = $${countParamIndex++}`);
-      countParams.push(teamId);
-    }
-    if (userId && !((_h = entityConfig.access) == null ? void 0 : _h.shared) && !skipUserFilter) {
-      countWhereConditions.push(`"userId" = $${countParamIndex++}`);
-      countParams.push(userId);
-    }
-    if (searchParam && searchParam.trim() !== "") {
-      const searchTerm = searchParam.trim();
-      const hasName = entityConfig.fields.some((f) => f.name === "name");
-      const hasTitle = entityConfig.fields.some((f) => f.name === "title");
-      const hasSlug = entityConfig.fields.some((f) => f.name === "slug");
-      const hasContent = entityConfig.fields.some((f) => f.name === "content");
-      if (hasName || hasTitle || hasSlug || hasContent) {
-        const searchConditions = [];
-        if (hasName) {
-          searchConditions.push(`name ILIKE $${countParamIndex}`);
-        }
-        if (hasTitle) {
-          searchConditions.push(`title ILIKE $${countParamIndex}`);
-        }
-        if (hasSlug) {
-          searchConditions.push(`slug ILIKE $${countParamIndex}`);
-        }
-        if (hasContent) {
-          searchConditions.push(`content ILIKE $${countParamIndex}`);
-        }
-        countWhereConditions.push(`(${searchConditions.join(" OR ")})`);
-        countParams.push(`%${searchTerm}%`);
-        countParamIndex++;
-      }
-    }
-    if (dateFieldName && (fromDate || toDate)) {
-      const field = entityConfig.fields.find((f) => f.name === dateFieldName);
-      if (field && (field.type === "datetime" || field.type === "date")) {
-        if (fromDate) {
-          countWhereConditions.push(`"${dateFieldName}" >= $${countParamIndex++}`);
-          countParams.push(fromDate);
-        }
-        if (toDate) {
-          countWhereConditions.push(`"${dateFieldName}" <= $${countParamIndex++}`);
-          countParams.push(toDate);
-        }
-      }
-    }
-    Object.entries(customFilters).forEach(([key, values]) => {
-      const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && values.length > 0) {
-        const columnName = `"${key}"`;
-        if (field.type === "relation-multi" || key === "socialPlatformId") {
-          const orConditions = values.map(() => {
-            const condition = `${columnName}::jsonb @> $${countParamIndex++}::jsonb`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(JSON.stringify([value]));
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        } else {
-          const orConditions = values.map(() => {
-            const condition = `${columnName} = $${countParamIndex++}`;
-            return condition;
-          });
-          values.forEach((value) => {
-            countParams.push(value);
-          });
-          countWhereConditions.push(`(${orConditions.join(" OR ")})`);
-        }
-      }
+    const rawData = await queryWithRLS(query, queryParams, userId);
+    const total = rawData.length > 0 ? Number(rawData[0].total_count) || 0 : 0;
+    const data = rawData.map((row) => {
+      const { total_count, ...rest } = row;
+      return rest;
     });
-    if (taxonomyFilter == null ? void 0 : taxonomyFilter.taxonomyId) {
-      countWhereConditions.push(`EXISTS (
-        SELECT 1 FROM entity_taxonomy_relations etr
-        WHERE etr."entityId" = id::text
-          AND etr."entityType" = '${entityConfig.slug}'
-          AND etr."taxonomyId" = $${countParamIndex++}
-      )`);
-      countParams.push(taxonomyFilter.taxonomyId);
-    }
-    const countWhereClause = countWhereConditions.length > 0 ? `WHERE ${countWhereConditions.join(" AND ")}` : "";
-    totalResult = await queryWithRLS(
-      `SELECT COUNT(*) as count FROM "${tableName}" ${countWhereClause}`,
-      countParams,
-      userId
-    );
-    const total = ((_i = totalResult[0]) == null ? void 0 : _i.count) || 0;
     const paginationMeta = createPaginationMeta(pagination.page, pagination.limit, total);
     let dataWithMeta = data;
     if (metaParams.includeMetadata && userId) {
@@ -520,84 +770,123 @@ async function handleGenericList(request) {
       );
     }
     let dataWithTaxonomies = dataWithChild;
-    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
+    if ((_m = entityConfig.taxonomies) == null ? void 0 : _m.enabled) {
       dataWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         dataWithChild,
         userId
       );
     }
-    const response = createApiResponse(dataWithTaxonomies, paginationMeta);
-    return addCorsHeaders(response);
+    const finalData = filterPublicFields(dataWithTaxonomies, entityConfig, userId);
+    const shapedData = await afterEntityRead(entityConfig.slug, finalData, { ...customFilters }, userId ?? void 0);
+    const response = createApiResponse(shapedData, paginationMeta);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic list handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericCreate(request) {
-  var _a, _b, _c, _d, _e, _f, _g;
+  return runWithAuditLog(request, (audit) => handleGenericCreateImpl(request, audit));
+}
+async function handleGenericCreateImpl(request, audit) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
   try {
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "create")) {
       const response2 = createApiError("Create operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
-    const authResult = await authenticateRequest(request);
+    const authResult = await authenticateRequest(request, { requiredScope: `${resolution.entityConfig.slug}:write` });
+    audit.auth = authResult;
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
-      const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
-    }
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const rawUserId = entityData.userId;
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
     const schemas = generateEntitySchemas(entityConfig);
-    const validation = schemas.create.safeParse(entityData);
+    const validation = schemas.create.safeParse(omitHandlerManagedKeys(entityConfig, entityData));
     if (!validation.success) {
       console.error(`[${entityConfig.slug}] Validation failed:`, {
         entityData,
         errors: validation.error.issues
       });
-      const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      const response2 = createApiError(
+        validationErrorMessage(validation.error.issues),
+        400,
+        validation.error.issues,
+        "VALIDATION_ERROR"
+      );
+      return addCorsHeaders(response2, request);
+    }
+    let validatedData = validation.data;
+    const xssField = checkNameFieldXss(entityConfig, validatedData);
+    if (xssField) {
+      const xssResponse = createApiError(
+        `Field '${xssField}' must not contain HTML markup`,
+        400,
+        void 0,
+        "INVALID_FIELD_VALUE"
+      );
+      return addCorsHeaders(xssResponse, request);
     }
-    const validatedData = validation.data;
     const idStrategy = ((_a = entityConfig.idStrategy) == null ? void 0 : _a.type) || "uuid";
     let insertFields;
     let placeholders;
     let values;
     let paramCount;
     const isSharedEntity = ((_b = entityConfig.access) == null ? void 0 : _b.shared) === true;
-    const userIdToUse = isSharedEntity && rawUserId ? rawUserId : authResult.user.id;
+    let userIdToUse = authResult.user.id;
+    if (isSharedEntity && Object.prototype.hasOwnProperty.call(entityData, "userId")) {
+      if (rawUserId === null) {
+        userIdToUse = null;
+      } else if (typeof rawUserId === "string" && rawUserId.trim() !== "") {
+        userIdToUse = rawUserId;
+      }
+    }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
-    if (!teamValidation.valid) {
+    if (teamValidation.valid === false) {
       return teamValidation.error;
     }
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for create operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
+    }
+    const permDenied = await checkAuthPermission(authResult, entityConfig.slug, "create", teamId, request);
+    if (permDenied) return permDenied;
+    try {
+      validatedData = await beforeEntityCreate(
+        entityConfig.slug,
+        { ...validatedData, userId: userIdToUse, teamId },
+        authResult.user.id
+      );
+    } catch (hookError) {
+      console.error(`[generic-handler] beforeEntityCreate rejected ${entityConfig.slug} create:`, hookError);
+      const response2 = createApiError(
+        hookError instanceof Error && hookError.message ? hookError.message : `Create rejected by ${entityConfig.slug} before_create hook`,
+        hookRejectionStatus(hookError),
+        void 0,
+        "BEFORE_CREATE_REJECTED"
+      );
+      return addCorsHeaders(response2, request);
     }
     if (idStrategy === "serial") {
       insertFields = ['"userId"', '"teamId"'];
@@ -614,7 +903,8 @@ async function handleGenericCreate(request) {
     const builderRequest = isBuilderRequest(request);
     const entityHasBuilder = ((_c = entityConfig.builder) == null ? void 0 : _c.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in validatedData) {
-      const blocksValue = validatedData.blocks;
+      let blocksValue = validatedData.blocks;
+      blocksValue = await filterOrphanedPatternReferences(blocksValue, authResult.user.id);
       insertFields.push('"blocks"');
       placeholders.push(`$${paramCount++}::jsonb`);
       values.push(JSON.stringify(blocksValue));
@@ -624,7 +914,7 @@ async function handleGenericCreate(request) {
       var _a2, _b2;
       if (key === "userId" || key === "teamId") return;
       const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly) && field.display.showInForm !== false) {
+      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly)) {
         const columnName = `"${key}"`;
         insertFields.push(columnName);
         if (field.type === "relation") {
@@ -644,7 +934,9 @@ async function handleGenericCreate(request) {
           values.push(relationId);
         } else if (field.type === "relation-multi") {
           placeholders.push(`$${paramCount++}::jsonb`);
-          values.push(value);
+          values.push(
+            typeof value === "string" ? value : JSON.stringify(Array.isArray(value) ? value : [])
+          );
         } else if (field.type === "tags") {
           placeholders.push(`$${paramCount++}::jsonb`);
           values.push(JSON.stringify(Array.isArray(value) ? value : []));
@@ -670,14 +962,46 @@ async function handleGenericCreate(request) {
         }
       }
     });
+    const createAction = `${entityConfig.slug}.create`;
+    const limitSlug = (_f = (_e = (_d = BILLING_REGISTRY) == null ? void 0 : _d.actionMappings) == null ? void 0 : _e.limits) == null ? void 0 : _f[createAction];
+    if (limitSlug) {
+      const actionResult = await SubscriptionService.canPerformAction(
+        authResult.user.id,
+        teamId,
+        createAction
+      );
+      if (!actionResult.allowed) {
+        const statusCode = actionResult.reason === "quota_exceeded" ? 429 : 403;
+        const response2 = createApiError(
+          // @ts-expect-error — pre-existing type error, tracked in https://github.com/NextSpark-js/nextspark/issues/131
+          actionResult.message || `Quota exceeded for ${entityConfig.slug}`,
+          statusCode,
+          void 0,
+          actionResult.reason === "quota_exceeded" ? "QUOTA_EXCEEDED" : "FEATURE_NOT_IN_PLAN"
+        );
+        return addCorsHeaders(response2, request);
+      }
+    }
     const insertQuery = `
       INSERT INTO "${tableName}" (${insertFields.join(", ")})
       VALUES (${placeholders.join(", ")}) RETURNING *
     `;
     const insertResult = await mutateWithRLS(insertQuery, values, authResult.user.id);
-    const createdEntityId = String((_d = insertResult.rows[0]) == null ? void 0 : _d.id);
-    const systemFields = ["id", "userId", "createdAt", "updatedAt"];
-    if ((_e = entityConfig.builder) == null ? void 0 : _e.enabled) {
+    const createdEntityId = String((_g = insertResult.rows[0]) == null ? void 0 : _g.id);
+    if (limitSlug) {
+      UsageService.track({
+        teamId,
+        userId: authResult.user.id,
+        limitSlug,
+        delta: 1,
+        action: createAction,
+        resourceType: entityConfig.slug,
+        resourceId: createdEntityId
+      }).catch(() => {
+      });
+    }
+    const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
+    if ((_h = entityConfig.builder) == null ? void 0 : _h.enabled) {
       systemFields.push("blocks");
     }
     const configFields = entityConfig.fields.map((field) => {
@@ -696,7 +1020,7 @@ async function handleGenericCreate(request) {
     `;
     const createdItems = await queryWithRLS(selectQuery, [createdEntityId], authResult.user.id);
     const createdItem = createdItems[0];
-    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
+    if ((_i = entityConfig.taxonomies) == null ? void 0 : _i.enabled) {
       await processTaxonomyRelations(entityConfig, createdEntityId, body, authResult.user.id, false);
     }
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
@@ -709,7 +1033,7 @@ async function handleGenericCreate(request) {
       );
     }
     let responseItem = createdItem;
-    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
+    if ((_j = entityConfig.taxonomies) == null ? void 0 : _j.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [createdItem],
@@ -729,57 +1053,70 @@ async function handleGenericCreate(request) {
       console.error(`[generic-handler] Error in afterEntityCreate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData, { created: true }, 201);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic create handler:", error);
+    const constraintResponse = mapConstraintViolation(error, "create");
+    if (constraintResponse) {
+      return addCorsHeaders(constraintResponse, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericRead(request, { params }) {
-  var _a, _b, _c, _d;
+  return runWithAuditLog(request, (audit) => handleGenericReadImpl(request, audit, { params }));
+}
+async function handleGenericReadImpl(request, audit, { params }) {
+  var _a, _b, _c, _d, _e, _f, _g;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "read")) {
       const response2 = createApiError("Read operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
-    const authResult = await authenticateRequest(request);
+    const authResult = await authenticateRequest(request, { requiredScope: `${resolution.entityConfig.slug}:read` });
+    audit.auth = authResult;
     let userId = null;
     let teamId = null;
+    let isBypass = false;
+    if (!authResult.success && authResult.type === "api-key") {
+      return addCorsHeaders(createAuthFailureResponse(authResult), request);
+    }
     if (!authResult.success && ((_a = resolution.entityConfig.access) == null ? void 0 : _a.public)) {
       console.log(`[GenericHandler] Public access allowed for ${resolution.entityConfig.slug} read`);
     } else if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     } else {
       if (authResult.rateLimitResponse) {
         return authResult.rateLimitResponse;
       }
-      if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:read`)) {
-        const response2 = createApiError("Insufficient permissions", 403);
-        return addCorsHeaders(response2);
-      }
       userId = authResult.user.id;
       const teamValidation = await validateTeamContextWithBypass(request, authResult, userId);
-      if (!teamValidation.valid) {
+      if (teamValidation.valid === false) {
         return teamValidation.error;
       }
       teamId = teamValidation.teamId;
+      isBypass = teamValidation.isBypass;
+      if (!isBypass && teamId) {
+        const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "read", teamId, request);
+        if (permDenied) return permDenied;
+      }
     }
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
-    const systemFields = ["id", "createdAt", "updatedAt"];
+    const systemFields = ["id", "userId", "teamId", "createdAt", "updatedAt"];
     if ((_b = entityConfig.builder) == null ? void 0 : _b.enabled) {
       systemFields.push("blocks");
     }
+    if ((_c = entityConfig.table) == null ? void 0 : _c.softDelete) {
+      systemFields.push("deletedAt", "deletedBy");
+    }
     const configFields = entityConfig.fields.map((field) => {
       const columnName = /[A-Z]/.test(field.name) ? `"${field.name}"` : field.name;
       return `t.${columnName}`;
@@ -789,6 +1126,7 @@ async function handleGenericRead(request, { params }) {
       return `t.${columnName}`;
     });
     const fields = [...systemFieldsFormatted, ...configFields].join(", ");
+    const forcePublishedOnly = ((_d = entityConfig.access) == null ? void 0 : _d.public) === true && userId === null && entityConfig.fields.some((f) => f.name === "status");
     let query;
     let queryParams;
     let paramIndex = 1;
@@ -802,14 +1140,36 @@ async function handleGenericRead(request, { params }) {
       query += ` AND t."teamId" = $${paramIndex++}`;
       queryParams.push(teamId);
     }
-    if (userId && !((_c = entityConfig.access) == null ? void 0 : _c.shared)) {
+    if (userId && !((_e = entityConfig.access) == null ? void 0 : _e.shared) && !isBypass) {
       query += ` AND t."userId" = $${paramIndex++}`;
       queryParams.push(userId);
     }
+    if (userId && teamId) {
+      const readOwnershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        userId,
+        teamId,
+        isBypass
+      );
+      if (readOwnershipFilter.applies) {
+        if (readOwnershipFilter.value === null) {
+          const response2 = createApiError("Item not found", 404);
+          return addCorsHeaders(response2, request);
+        }
+        query += ` AND t."${readOwnershipFilter.field}" = $${paramIndex++}`;
+        queryParams.push(readOwnershipFilter.value);
+      }
+    }
+    if (((_f = entityConfig.table) == null ? void 0 : _f.softDelete) && !isBypass) {
+      query += ` AND t."deletedAt" IS NULL`;
+    }
+    if (forcePublishedOnly) {
+      query += ` AND t."status" = 'published'`;
+    }
     const items = await queryWithRLS(query, queryParams, userId);
     if (!items[0]) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const item = items[0];
     const metaParams = parseMetaParams(request);
@@ -836,7 +1196,7 @@ async function handleGenericRead(request, { params }) {
       itemWithChild = itemsWithChild[0] || itemWithMeta;
     }
     let itemWithTaxonomies = itemWithChild;
-    if ((_d = entityConfig.taxonomies) == null ? void 0 : _d.enabled) {
+    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [itemWithChild],
@@ -844,79 +1204,138 @@ async function handleGenericRead(request, { params }) {
       );
       itemWithTaxonomies = itemsWithTaxonomies[0] || itemWithChild;
     }
-    const response = createApiResponse(itemWithTaxonomies);
-    return addCorsHeaders(response);
+    const finalItem = filterPublicFields(itemWithTaxonomies, entityConfig, userId);
+    const [shapedItem] = await afterEntityRead(entityConfig.slug, [finalItem], { id }, userId ?? void 0);
+    const response = createApiResponse(shapedItem ?? finalItem);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic read handler:", error);
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericUpdate(request, { params }) {
-  var _a, _b, _c, _d;
+  return runWithAuditLog(request, (audit) => handleGenericUpdateImpl(request, audit, { params }));
+}
+async function handleGenericUpdateImpl(request, audit, { params }) {
+  var _a, _b, _c, _d, _e, _f, _g;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "update")) {
       const response2 = createApiError("Update operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
-    const authResult = await authenticateRequest(request);
+    const authResult = await authenticateRequest(request, { requiredScope: `${resolution.entityConfig.slug}:write` });
+    audit.auth = authResult;
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
-      const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
-    }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
-    if (!teamValidation.valid) {
+    if (teamValidation.valid === false) {
       return teamValidation.error;
     }
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for update operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
+    const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "update", teamId, request);
+    if (permDenied) return permDenied;
     let body;
     try {
       body = await request.json();
     } catch {
       const response2 = createApiError("Invalid JSON body", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     const { metas, ...entityData } = body;
     const entityConfig = resolution.entityConfig;
+    const fieldGuards = (_b = (_a = entityConfig.access) == null ? void 0 : _a.ownershipFilter) == null ? void 0 : _b.fieldGuards;
+    if (fieldGuards && fieldGuards.length > 0 && ((_c = authResult.user) == null ? void 0 : _c.id)) {
+      const guardMemberRow = await queryOneWithRLS(
+        'SELECT role FROM "team_members" WHERE "teamId" = $1 AND "userId" = $2',
+        [teamId, authResult.user.id],
+        authResult.user.id
+      );
+      if (guardMemberRow) {
+        for (const guard of fieldGuards) {
+          if (guard.roles.includes(guardMemberRow.role)) {
+            const forbidden = guard.denyFields.filter((f) => f in entityData);
+            if (forbidden.length > 0) {
+              const response2 = createApiError(
+                `Role '${guardMemberRow.role}' is not allowed to modify field(s): ${forbidden.join(", ")}`,
+                403,
+                void 0,
+                "FIELD_MODIFICATION_DENIED"
+              );
+              return addCorsHeaders(response2, request);
+            }
+          }
+        }
+      }
+    }
     const tableName = getTableName(entityConfig);
     const schemas = generateEntitySchemas(entityConfig);
-    const validation = schemas.update.safeParse(entityData);
+    const validation = schemas.update.safeParse(omitHandlerManagedKeys(entityConfig, entityData));
     if (!validation.success) {
       console.log(`[${entityConfig.slug}] Validation failed:`, {
         entityData,
         errors: validation.error.issues
       });
-      const response2 = createApiError("Validation error", 400, validation.error.issues, "VALIDATION_ERROR");
-      return addCorsHeaders(response2);
+      const response2 = createApiError(
+        validationErrorMessage(validation.error.issues),
+        400,
+        validation.error.issues,
+        "VALIDATION_ERROR"
+      );
+      return addCorsHeaders(response2, request);
+    }
+    let validatedData = validation.data;
+    const updateXssField = checkNameFieldXss(entityConfig, validatedData);
+    if (updateXssField) {
+      const updateXssResponse = createApiError(
+        `Field '${updateXssField}' must not contain HTML markup`,
+        400,
+        void 0,
+        "INVALID_FIELD_VALUE"
+      );
+      return addCorsHeaders(updateXssResponse, request);
+    }
+    try {
+      validatedData = await beforeEntityUpdate(
+        entityConfig.slug,
+        id,
+        validatedData,
+        authResult.user.id
+      );
+    } catch (hookError) {
+      console.error(`[generic-handler] beforeEntityUpdate rejected ${entityConfig.slug} update:`, hookError);
+      const response2 = createApiError(
+        hookError instanceof Error && hookError.message ? hookError.message : `Update rejected by ${entityConfig.slug} before_update hook`,
+        hookRejectionStatus(hookError),
+        void 0,
+        "BEFORE_UPDATE_REJECTED"
+      );
+      return addCorsHeaders(response2, request);
     }
-    const validatedData = validation.data;
     const updates = [];
     const values = [];
     let paramCount = 1;
     const builderRequest = isBuilderRequest(request);
-    const entityHasBuilder = ((_a = entityConfig.builder) == null ? void 0 : _a.enabled) === true;
+    const entityHasBuilder = ((_d = entityConfig.builder) == null ? void 0 : _d.enabled) === true;
     if (builderRequest && entityHasBuilder && "blocks" in entityData) {
+      let blocksData = entityData.blocks;
+      blocksData = await filterOrphanedPatternReferences(blocksData, authResult.user.id);
       updates.push(`"blocks" = $${paramCount++}::jsonb`);
-      values.push(JSON.stringify(entityData.blocks));
+      values.push(JSON.stringify(blocksData));
     }
     const originalKeys = Object.keys(entityData);
     const fieldsToUpdate = Object.entries(validatedData).filter(([key]) => originalKeys.includes(key));
@@ -924,7 +1343,7 @@ async function handleGenericUpdate(request, { params }) {
       var _a2, _b2;
       if (key === "blocks") return;
       const field = entityConfig.fields.find((f) => f.name === key);
-      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly) && field.display.showInForm !== false) {
+      if (field && !((_a2 = field.api) == null ? void 0 : _a2.readOnly)) {
         const columnName = `"${key}"`;
         if (field.type === "relation") {
           let relationId = null;
@@ -943,7 +1362,9 @@ async function handleGenericUpdate(request, { params }) {
           values.push(relationId);
         } else if (field.type === "relation-multi") {
           updates.push(`${columnName} = $${paramCount++}::jsonb`);
-          values.push(value);
+          values.push(
+            typeof value === "string" ? value : JSON.stringify(Array.isArray(value) ? value : [])
+          );
         } else if (field.type === "tags") {
           updates.push(`${columnName} = $${paramCount++}::jsonb`);
           values.push(JSON.stringify(Array.isArray(value) ? value : []));
@@ -972,7 +1393,7 @@ async function handleGenericUpdate(request, { params }) {
     const metadataWasProvided = metas && typeof metas === "object" && Object.keys(metas).length > 0;
     if (updates.length === 0 && !metadataWasProvided) {
       const response2 = createApiError("No fields to update", 400);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (updates.length > 0) {
       updates.push(`"updatedAt" = CURRENT_TIMESTAMP`);
@@ -985,10 +1406,24 @@ async function handleGenericUpdate(request, { params }) {
         whereConditions.push(`"teamId" = $${paramCount++}`);
         values.push(teamId);
       }
-      if (!((_b = entityConfig.access) == null ? void 0 : _b.shared)) {
+      if (!((_e = entityConfig.access) == null ? void 0 : _e.shared)) {
         whereConditions.push(`"userId" = $${paramCount++}`);
         values.push(authResult.user.id);
       }
+      const updateOwnershipFilter = await resolveOwnershipFilter(
+        entityConfig,
+        authResult.user.id,
+        teamId,
+        teamValidation.isBypass
+      );
+      if (updateOwnershipFilter.applies) {
+        if (updateOwnershipFilter.value === null) {
+          const response2 = createApiError("Item not found", 404);
+          return addCorsHeaders(response2, request);
+        }
+        whereConditions.push(`"${updateOwnershipFilter.field}" = $${paramCount++}`);
+        values.push(updateOwnershipFilter.value);
+      }
       const updateQuery = `
         UPDATE "${tableName}"
         SET ${updates.join(", ")}
@@ -998,7 +1433,7 @@ async function handleGenericUpdate(request, { params }) {
       const result = await mutateWithRLS(updateQuery, values, authResult.user.id);
       if (!result.rows || result.rows.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result.rows[0];
     } else {
@@ -1011,11 +1446,11 @@ async function handleGenericUpdate(request, { params }) {
       const result = await queryWithRLS(selectQuery, selectValues, authResult.user.id);
       if (!result || result.length === 0) {
         const response2 = createApiError("Item not found", 404);
-        return addCorsHeaders(response2);
+        return addCorsHeaders(response2, request);
       }
       updatedItem = result[0];
     }
-    if ((_c = entityConfig.taxonomies) == null ? void 0 : _c.enabled) {
+    if ((_f = entityConfig.taxonomies) == null ? void 0 : _f.enabled) {
       await processTaxonomyRelations(entityConfig, id, body, authResult.user.id, true);
     }
     if (metadataWasProvided) {
@@ -1027,7 +1462,7 @@ async function handleGenericUpdate(request, { params }) {
       );
     }
     let responseItem = updatedItem;
-    if ((_d = entityConfig.taxonomies) == null ? void 0 : _d.enabled) {
+    if ((_g = entityConfig.taxonomies) == null ? void 0 : _g.enabled) {
       const itemsWithTaxonomies = await includeTaxonomiesInData(
         entityConfig,
         [updatedItem],
@@ -1047,51 +1482,75 @@ async function handleGenericUpdate(request, { params }) {
       console.error(`[generic-handler] Error in afterEntityUpdate hook for ${entityConfig.slug}:`, hookError);
     }
     const response = createApiResponse(responseData);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic update handler:", error);
+    const constraintResponse = mapConstraintViolation(error, "update");
+    if (constraintResponse) {
+      return addCorsHeaders(constraintResponse, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
 async function handleGenericDelete(request, { params }) {
-  var _a;
+  return runWithAuditLog(request, (audit) => handleGenericDeleteImpl(request, audit, { params }));
+}
+async function handleGenericDeleteImpl(request, audit, { params }) {
+  var _a, _b, _c, _d, _e;
   try {
     const { id } = await params;
     const resolution = await resolveEntityFromUrl(request.nextUrl.pathname);
     if (!resolution.isValidEntity || !resolution.entityConfig) {
       const response2 = createApiError("Entity not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     if (!validateEntityOperation(resolution.entityConfig, "delete")) {
       const response2 = createApiError("Delete operation not supported for this entity", 405);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
-    const authResult = await authenticateRequest(request);
+    const authResult = await authenticateRequest(request, { requiredScope: `${resolution.entityConfig.slug}:delete` });
+    audit.auth = authResult;
     if (!authResult.success) {
-      return NextResponse.json(
-        { success: false, error: "Authentication required", code: "AUTHENTICATION_FAILED" },
-        { status: 401 }
-      );
+      return createAuthFailureResponse(authResult);
     }
     if (authResult.rateLimitResponse) {
       return authResult.rateLimitResponse;
     }
-    if (!hasRequiredScope(authResult, `${resolution.entityConfig.slug}:write`)) {
-      const response2 = createApiError("Insufficient permissions", 403);
-      return addCorsHeaders(response2);
-    }
     const teamValidation = await validateTeamContextWithBypass(request, authResult, authResult.user.id);
-    if (!teamValidation.valid) {
+    if (teamValidation.valid === false) {
       return teamValidation.error;
     }
     const teamId = teamValidation.teamId;
     if (!teamId) {
       const response2 = createApiError("Team context required for delete operations. Include x-team-id header.", 400, void 0, "TEAM_CONTEXT_REQUIRED");
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
+    const permDenied = await checkAuthPermission(authResult, resolution.entityConfig.slug, "delete", teamId, request);
+    if (permDenied) return permDenied;
     const entityConfig = resolution.entityConfig;
     const tableName = getTableName(entityConfig);
+    try {
+      const allowDelete = await beforeEntityDelete(entityConfig.slug, id, authResult.user.id);
+      if (!allowDelete) {
+        const response2 = createApiError(
+          `Delete rejected by ${entityConfig.slug} before_delete hook`,
+          403,
+          void 0,
+          "BEFORE_DELETE_REJECTED"
+        );
+        return addCorsHeaders(response2, request);
+      }
+    } catch (hookError) {
+      console.error(`[generic-handler] beforeEntityDelete rejected ${entityConfig.slug} delete:`, hookError);
+      const response2 = createApiError(
+        hookError instanceof Error && hookError.message ? hookError.message : `Delete rejected by ${entityConfig.slug} before_delete hook`,
+        hookRejectionStatus(hookError),
+        void 0,
+        "BEFORE_DELETE_REJECTED"
+      );
+      return addCorsHeaders(response2, request);
+    }
     const whereConditions = ["id = $1"];
     const deleteParams = [id];
     let paramIndex = 2;
@@ -1103,31 +1562,61 @@ async function handleGenericDelete(request, { params }) {
       whereConditions.push(`"userId" = $${paramIndex++}`);
       deleteParams.push(authResult.user.id);
     }
-    const deleteQuery = `
-      DELETE FROM "${tableName}"
-      WHERE ${whereConditions.join(" AND ")}
-      RETURNING id
-    `;
+    let deleteQuery;
+    if ((_b = entityConfig.table) == null ? void 0 : _b.softDelete) {
+      whereConditions.push(`"deletedAt" IS NULL`);
+      deleteQuery = `
+        UPDATE "${tableName}"
+        SET "deletedAt" = NOW(), "deletedBy" = $${paramIndex++}
+        WHERE ${whereConditions.join(" AND ")}
+        RETURNING id
+      `;
+      deleteParams.push(authResult.user.id);
+    } else {
+      deleteQuery = `
+        DELETE FROM "${tableName}"
+        WHERE ${whereConditions.join(" AND ")}
+        RETURNING id
+      `;
+    }
     const result = await mutateWithRLS(deleteQuery, deleteParams, authResult.user.id);
     if (!result.rows || result.rows.length === 0) {
       const response2 = createApiError("Item not found", 404);
-      return addCorsHeaders(response2);
+      return addCorsHeaders(response2, request);
     }
     try {
       await afterEntityDelete(entityConfig.slug, id, authResult.user.id);
     } catch (hookError) {
       console.error(`[generic-handler] Error in afterEntityDelete hook for ${entityConfig.slug}:`, hookError);
     }
+    const deleteAction = `${entityConfig.slug}.create`;
+    const deleteLimitSlug = (_e = (_d = (_c = BILLING_REGISTRY) == null ? void 0 : _c.actionMappings) == null ? void 0 : _d.limits) == null ? void 0 : _e[deleteAction];
+    if (deleteLimitSlug) {
+      UsageService.track({
+        teamId,
+        userId: authResult.user.id,
+        limitSlug: deleteLimitSlug,
+        delta: -1,
+        action: `${entityConfig.slug}.delete`,
+        resourceType: entityConfig.slug,
+        resourceId: id
+      }).catch(() => {
+      });
+    }
     const response = createApiResponse({ success: true, id });
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   } catch (error) {
     console.error("Error in generic delete handler:", error);
+    const constraintResponse = mapConstraintViolation(error, "delete");
+    if (constraintResponse) {
+      return addCorsHeaders(constraintResponse, request);
+    }
     const response = createApiError("Internal server error", 500);
-    return addCorsHeaders(response);
+    return addCorsHeaders(response, request);
   }
 }
-async function handleGenericOptions() {
-  return handleCorsPreflightRequest();
+async function handleGenericOptions(request) {
+  return handleCorsPreflightRequest(request);
 }
 async function handleDistinctJsonbField(entityConfig, fieldName, url, userId) {
   var _a;