@open-mercato/core 0.10.1-develop.7776.1.3032ea0741 → 0.10.1-develop.7781.1.079f42c863

package/src/modules/query_index/lib/search-scope.ts

@@ -0,0 +1,144 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { sql, type Kysely, type RawBuilder } from 'kysely'
+import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
+import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { resolveQueryIndexSourceMetadata } from './subscriber-scope'
+import { listTenantGlobalEntityTypes } from './tenant-global'
+
+export type QueryIndexSearchScope = {
+  searchableEntityTypes: readonly string[]
+  blockedEntityTypes: readonly string[]
+  tenantGlobalEntityTypes: readonly string[]
+  registeredSourceTypes?: readonly string[]
+  customEntityStorage?: boolean
+  customEntityStorageSchema?: string | null
+}
+
+type ScopeSnapshot = QueryIndexSearchScope & { registeredSourceTypes: readonly string[]; customEntityStorage: boolean; customEntityStorageSchema: string | null }
+type ScopeCacheEntry = { signature: string; result: Promise<ScopeSnapshot> }
+const SEARCH_SCOPE_CACHE_KEY = Symbol.for('@open-mercato/query-index/verified-search-scope')
+type ScopeGlobals = typeof globalThis & { [SEARCH_SCOPE_CACHE_KEY]?: WeakMap<object, ScopeCacheEntry> }
+
+function scopeCache(): WeakMap<object, ScopeCacheEntry> {
+  const scope = globalThis as ScopeGlobals
+  return scope[SEARCH_SCOPE_CACHE_KEY] ??= new WeakMap<object, ScopeCacheEntry>()
+}
+
+export async function resolveQueryIndexSearchScope(entityManager?: EntityManager): Promise<QueryIndexSearchScope> {
+  let manager = entityManager
+  if (!manager) {
+    const { getOrm } = await import('@open-mercato/shared/lib/db/mikro')
+    try {
+      manager = (await getOrm()).em
+    } catch {
+      return { searchableEntityTypes: [], tenantGlobalEntityTypes: [], blockedEntityTypes: [...new Set(Object.values(getEntityIds(false)).flatMap((entities) => Object.values(entities)))] }
+    }
+  }
+  const entityTypes = [...new Set(Object.values(getEntityIds(false)).flatMap((entities) => Object.values(entities)))].sort((leftType, rightType) => leftType.localeCompare(rightType))
+  if (!entityTypes.length) throw new Error('[internal] Query-index source registry is unavailable; refusing unverified search')
+  const declaredTypes = listTenantGlobalEntityTypes().sort((leftType, rightType) => leftType.localeCompare(rightType))
+  const metadataSignature = listEntityMetadata(manager).map((metadata) => [metadata.className, metadata.tableName, metadata.schema, metadata.properties?.tenantId?.fieldNames, metadata.properties?.organizationId?.fieldNames])
+  const signature = JSON.stringify([entityTypes, declaredTypes, metadataSignature])
+  const key = manager.getDriver()
+  const cache = scopeCache()
+  const cached = cache.get(key)
+  const result = cached?.signature === signature ? cached.result : verifySearchScope(manager, entityTypes, new Set(declaredTypes))
+  const entry = cached?.signature === signature ? cached : { signature, result }
+  cache.set(key, entry)
+  try {
+    return await result
+  } catch (error) {
+    if (cache.get(key) === entry) cache.delete(key)
+    throw error
+  }
+}
+
+async function verifySearchScope(
+  em: EntityManager,
+  entityTypes: readonly string[],
+  declaredTypes: ReadonlySet<string>,
+): Promise<ScopeSnapshot> {
+  const metadata = listEntityMetadata(em)
+  const sources = entityTypes.flatMap((entityType) => {
+    try {
+      const source = resolveQueryIndexSourceMetadata(em, entityType)
+      return [{ entityType, ...source, table: source.tableName ?? source.table, schema: source.schema ?? null }]
+    } catch {
+      return []
+    }
+  })
+  const customStorageMatches = metadata.filter((entry) => entry.className === 'CustomEntityStorage' || entry.name === 'CustomEntityStorage')
+  const customStorageMetadata = customStorageMatches.length === 1 ? customStorageMatches[0] : undefined
+  const customStorageRegistered = Boolean(customStorageMetadata)
+  const customEntityStorageSchema = customStorageMetadata?.schema && customStorageMetadata.schema !== '*' ? customStorageMetadata.schema : null
+  const physicalSchemas = [...new Set([...sources.flatMap((source) => source.schema ? [source.schema] : []), ...(customEntityStorageSchema ? [customEntityStorageSchema] : [])])]
+  if (!sources.length && !customStorageRegistered) return { searchableEntityTypes: [], tenantGlobalEntityTypes: [], registeredSourceTypes: [], blockedEntityTypes: [...entityTypes], customEntityStorage: false, customEntityStorageSchema: null }
+  const db = em.getKysely<{ 'information_schema.columns': { table_schema: string; table_name: string; column_name: string } }>()
+  const rows = await db.selectFrom('information_schema.columns')
+    .select(['table_schema', 'table_name', 'column_name'])
+    .select(sql<boolean>`table_schema = current_schema()`.as('is_current_schema'))
+    .where((expression) => expression.or([sql<boolean>`table_schema = current_schema()`, ...(physicalSchemas.length ? [expression('table_schema', 'in', physicalSchemas)] : [])]))
+    .where('table_name', 'in', [...new Set([...sources.map((source) => source.table), ...(customStorageRegistered ? ['custom_entities_storage'] : [])])])
+    .execute()
+  const columnsByTable = new Map<string, Set<string>>()
+  for (const row of rows) {
+    const key = `${row.table_schema}.${row.table_name}`
+    const columns = columnsByTable.get(key) ?? new Set<string>()
+    columns.add(row.column_name)
+    columnsByTable.set(key, columns)
+    if (row.is_current_schema) columnsByTable.set(row.table_name, columns)
+  }
+  const searchableEntityTypes: string[] = []
+  const tenantGlobalEntityTypes: string[] = []
+  for (const source of sources) {
+    const columns = columnsByTable.get(source.schema ? `${source.schema}.${source.table}` : source.table)
+    if (!columns?.has('id')) continue
+    const hasTenant = columns.has('tenant_id') || Boolean(source.tenantColumn && columns.has(source.tenantColumn))
+    const hasOrganization = columns.has('organization_id') || Boolean(source.organizationColumn && columns.has(source.organizationColumn))
+    const global = !source.tenantColumn && !source.organizationColumn && !hasTenant && !hasOrganization && declaredTypes.has(source.entityType)
+    if (global) tenantGlobalEntityTypes.push(source.entityType)
+    if (hasTenant || global) searchableEntityTypes.push(source.entityType)
+  }
+  return { searchableEntityTypes, tenantGlobalEntityTypes, blockedEntityTypes: sources.map((source) => source.entityType).filter((entityType) => !searchableEntityTypes.includes(entityType)), registeredSourceTypes: sources.map((source) => source.entityType), customEntityStorageSchema, customEntityStorage: customStorageRegistered && ['tenant_id', 'organization_id', 'entity_type', 'entity_id'].every((column) => columnsByTable.get(customEntityStorageSchema ? `${customEntityStorageSchema}.custom_entities_storage` : 'custom_entities_storage')?.has(column)) }
+}
+
+type SearchRecordIdentity = { entityId: string; recordId: string; tenantId: string; organizationId?: string | null }
+type CustomStorageDatabase = {
+  custom_entities_storage: { entity_type: string; entity_id: string; tenant_id: string | null; organization_id: string | null }
+}
+
+export function buildQueryIndexSearchScopePredicate(
+  scope: QueryIndexSearchScope,
+  target: { entityTypeRef: string; recordIdRef: string; organizationIdRef: string },
+  tenantId: string,
+): RawBuilder<boolean> {
+  const entityType = sql.ref(target.entityTypeRef)
+  const known = scope.searchableEntityTypes.length
+    ? sql<boolean>`${entityType} in (${sql.join(scope.searchableEntityTypes)})`
+    : sql<boolean>`false`
+  if (!scope.customEntityStorage) return known
+  const table = sql.id(...(scope.customEntityStorageSchema ? [scope.customEntityStorageSchema, 'custom_entities_storage'] : ['custom_entities_storage']))
+  const unknown = scope.registeredSourceTypes?.length
+    ? sql<boolean>`${entityType} not in (${sql.join(scope.registeredSourceTypes)})`
+    : sql<boolean>`true`
+  return sql<boolean>`(${known} or (${unknown} and exists (select 1 from ${table} as om_search_source where om_search_source.entity_type = ${entityType} and om_search_source.entity_id = (${sql.ref(target.recordIdRef)})::text and om_search_source.tenant_id = ${tenantId} and om_search_source.organization_id is not distinct from ${sql.ref(target.organizationIdRef)})))`
+}
+
+export async function filterQueryIndexSearchRecords<RecordType extends SearchRecordIdentity>(
+  db: Kysely<CustomStorageDatabase> | undefined,
+  scope: QueryIndexSearchScope,
+  records: readonly RecordType[],
+): Promise<RecordType[]> {
+  const known = new Set(scope.searchableEntityTypes)
+  const unknown = records.filter((record) => !known.has(record.entityId) && !scope.registeredSourceTypes?.includes(record.entityId))
+  if (!scope.customEntityStorage || !unknown.length) return records.filter((record) => known.has(record.entityId))
+  const source = db ?? (await (await import('@open-mercato/shared/lib/db/mikro')).getOrm()).em.getKysely<CustomStorageDatabase>()
+  const sourceDb = scope.customEntityStorageSchema ? source.withSchema(scope.customEntityStorageSchema) : source
+  const rows = await sourceDb.selectFrom('custom_entities_storage').select(['entity_type', 'entity_id', 'tenant_id', 'organization_id'])
+    .where('entity_type', 'in', [...new Set(unknown.map((record) => record.entityId))])
+    .where('entity_id', 'in', [...new Set(unknown.map((record) => record.recordId))])
+    .where('tenant_id', 'in', [...new Set(unknown.map((record) => record.tenantId))])
+    .execute()
+  const identities = new Set(rows.map((row) => JSON.stringify([row.entity_type, row.entity_id, row.tenant_id, row.organization_id])))
+  return records.filter((record) => known.has(record.entityId) || identities.has(JSON.stringify([record.entityId, record.recordId, record.tenantId, record.organizationId ?? null])))
+}

package/src/modules/query_index/lib/stale.ts

@@ -130,3 +130,76 @@ export async function purgeOrphans(
     ).catch(() => undefined)
   }
 }
+
+type RetireScopedCatalogueRowsOptions = {
+  entityType: string
+  partitionIndex: number | null
+  partitionCount: number | null
+  /** Records this run failed to write keep their old rows, as in `purgeOrphans`. */
+  excludeRecordIds?: string[]
+}
+
+type CatalogueRetirementDatabase = {
+  entity_indexes: { entity_type: string; entity_id: string; tenant_id: string | null; organization_id: string | null }
+  search_tokens: { entity_type: string; entity_id: string; tenant_id: string | null; organization_id: string | null }
+}
+
+/**
+ * Retire the projections and tokens a declared platform-wide catalogue accumulated before
+ * its canonical scope became `tenant_id = NULL, organization_id = NULL`.
+ *
+ * Earlier sweeps stamped the caller's tenant and organization. `entity_indexes` is unique on
+ * (entity_type, entity_id, organization_id_coalesced), so a row stamped with an organization
+ * is a different key from the canonical one: the upsert never rewrites it, and
+ * `purgeOrphans`, scoped to the canonical row, never selects it - it survives every sweep,
+ * even the deletion of its source record. Nothing writes a scoped row for such a type any
+ * more (the event path requires a null scope for it, and the sweep now writes one), so every
+ * scoped row is residue whichever tenant stamped it. Only call this for an entity type
+ * `reindexEntity` writes as a global projection.
+ */
+export async function retireScopedCatalogueRows(
+  db: Kysely<CatalogueRetirementDatabase>,
+  options: RetireScopedCatalogueRowsOptions,
+): Promise<void> {
+  const { entityType, partitionIndex, partitionCount } = options
+  const scoped = sql<boolean>`(tenant_id is not null or organization_id is not null)`
+  const inPartition = partitionIndex != null && partitionCount != null
+    ? sql<boolean>`mod(abs(hashtext(entity_id::text)), ${partitionCount}) = ${partitionIndex}`
+    : null
+
+  let projections = db.deleteFrom('entity_indexes').where('entity_type', '=', entityType).where(scoped)
+  if (inPartition) projections = projections.where(inPartition)
+  if (options.excludeRecordIds?.length) {
+    projections = projections.where('entity_id', 'not in', options.excludeRecordIds)
+  }
+  await projections.execute()
+
+  try {
+    if (!(await searchTokensTableExists(db))) return
+    let tokens = db.deleteFrom('search_tokens').where('entity_type', '=', entityType).where(scoped)
+    if (inPartition) tokens = tokens.where(inPartition)
+    if (options.excludeRecordIds?.length) {
+      tokens = tokens.where('entity_id', 'not in', options.excludeRecordIds)
+    }
+    tokens = tokens.where(sql<boolean>`not exists (
+      select 1 from entity_indexes as surviving
+      where surviving.entity_type = ${entityType}
+        and surviving.entity_id = search_tokens.entity_id
+        and surviving.tenant_id is not distinct from search_tokens.tenant_id
+        and surviving.organization_id is not distinct from search_tokens.organization_id
+    )`)
+    await tokens.execute()
+  } catch (searchTokenError) {
+    await recordIndexerError(
+      { db },
+      {
+        source: 'fulltext',
+        handler: 'query_index:retire-scoped-catalogue-rows',
+        error: searchTokenError,
+        entityType,
+        tenantId: null,
+        organizationId: null,
+      },
+    ).catch(() => undefined)
+  }
+}

package/src/modules/query_index/lib/subscriber-scope.ts

@@ -10,6 +10,8 @@ export type QueryIndexScope = {
 
 export type QueryIndexSourceMetadata = {
   table: string
+  schema?: string
+  tableName?: string
   organizationColumn: string | null
   tenantColumn: string | null
 }
@@ -21,6 +23,9 @@ export type QueryIndexSourceScope =
 
 type QueryIndexEntityMetadata = {
   tableName?: unknown
+  className?: unknown
+  name?: unknown
+  schema?: unknown
   properties?: Record<string, { fieldNames?: unknown }>
 }
 
@@ -54,19 +59,44 @@ export function resolveQueryIndexSourceMetadata(
     throw new QueryIndexScopeError(`Query index entity type is not registered: ${entityType}`)
   }
 
-  const table = resolveRegisteredEntityTableName(em, entityType as never)
-  if (!table) {
-    throw new QueryIndexScopeError(`Query index entity type has no registered ORM table: ${entityType}`)
-  }
+  const source = resolveQueryIndexSourceTableMetadata(em, entityType)
+  if (!source) throw new QueryIndexScopeError(`Query index entity type has no registered ORM table: ${entityType}`)
+  const listed = listEntityMetadata(em).some((metadata) => metadata.tableName === (source.tableName ?? source.table) && (metadata.schema && metadata.schema !== '*' ? metadata.schema : undefined) === source.schema)
+  if (!listed) throw new QueryIndexScopeError(`[internal] Query index entity metadata was not found for table: ${source.table}`)
+  return source
+}
 
+export function resolveQueryIndexSourceTableMetadata(
+  em: EntityManager,
+  entityType: string,
+): QueryIndexSourceMetadata | null {
+  const rawName = entityType.split(':').pop() ?? ''
+  const className = rawName.split(/[_\s]+/).filter(Boolean)
+    .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join('')
   const allMetadata = listEntityMetadata(em) as unknown as QueryIndexEntityMetadata[]
-  const metadata = allMetadata.find((candidate) => String(candidate.tableName ?? '') === table)
-  if (!metadata) {
-    throw new QueryIndexScopeError(`Query index entity metadata was not found for table: ${table}`)
+  let metadata: QueryIndexEntityMetadata | undefined
+  for (const candidate of [className, `${className}Entity`]) {
+    const matches = allMetadata.filter((entry) => entry.className === candidate || entry.name === candidate)
+    if (matches.length > 1) throw new QueryIndexScopeError(`[internal] Ambiguous query-index entity metadata: ${entityType}`)
+    if (matches.length === 1) {
+      metadata = matches[0]
+      break
+    }
   }
-
+  if (!metadata) {
+    const table = resolveRegisteredEntityTableName(em, entityType)
+    if (!table) return null
+    const matches = allMetadata.filter((entry) => entry.tableName === table)
+    if (matches.length !== 1) throw new QueryIndexScopeError(`[internal] Ambiguous query-index table metadata: ${entityType}`)
+    metadata = matches[0]
+  }
+  const tableName = String(metadata.tableName ?? '')
+  if (!tableName) return null
+  const schema = typeof metadata.schema === 'string' && metadata.schema !== '*' ? metadata.schema : undefined
+  const table = schema ? `${schema}.${tableName}` : tableName
   return {
     table,
+    ...(schema ? { schema, tableName } : {}),
     organizationColumn: resolveScopeColumn(metadata, 'organizationId', table),
     tenantColumn: resolveScopeColumn(metadata, 'tenantId', table),
   }

package/src/modules/query_index/lib/tenant-global.ts

@@ -0,0 +1,93 @@
+/**
+ * The narrow exception to the rule `reindexEntity` enforces: entity types whose
+ * source table has no `tenant_id` column BECAUSE the rows are one platform-wide
+ * catalogue that every tenant is meant to read.
+ *
+ * A declared type whose table has neither scope column is swept whole and its
+ * projection is written once, under `tenant_id = NULL, organization_id = NULL` -
+ * where the event path files it too - and every reader widens for exactly this
+ * physically verified set (see `search-scope`): `TokenSearchStrategy.search()` on both the tenant and the organization
+ * axis, `createPresenterEnricher()`'s `fetchDocsBatch()` on the tenant axis, and
+ * `SearchService`'s organization filter. A sweep also retires the rows earlier
+ * sweeps stamped with a caller's tenant and organization. Vector work is the one
+ * exception: it keeps the caller's scope, because its consumers need a real
+ * tenant. The null scope alone is never the signal - it is also how every
+ * private table with neither scope column is stored - which is why each branch
+ * is gated on this declaration.
+ *
+ * Everything else with no `tenant_id` column fails closed, INCLUDING entity
+ * types nobody has classified yet. That is the point of expressing this as an
+ * allowlist over a derived condition rather than as a denylist of known-private
+ * tables: a tenant-less entity type introduced by a later release is refused on
+ * arrival instead of quietly leaking until someone notices.
+ *
+ * The bar for admitting an entity type is "is every tenant MEANT to read every
+ * row", not "a reindex started refusing it". Of the fourteen entity types in
+ * this repository whose table has no `tenant_id` column, exactly one clears it;
+ * the other thirteen are private rows that must fail closed —
+ * `directory:tenant` (one row per tenant, `name` tokenised),
+ * `auth:user_role`, `auth:session`, `auth:password_reset`,
+ * `customers:customer_deal_person_link`, `messages:message_recipient` and the
+ * rest of that shape.
+ */
+const CORE_TENANT_GLOBAL_ENTITY_TYPES: readonly string[] = [
+  // No `tenant_id`; `feature_toggle_overrides` carries the per-tenant value.
+  // Its `default_value` is `jsonb`, which contributes no tokens.
+  'feature_toggles:feature_toggle',
+]
+
+const TENANT_GLOBAL_ENTITY_TYPES_KEY = Symbol.for('@open-mercato/query-index/tenant-global-entity-types')
+
+type GlobalWithTenantGlobalEntityTypes = typeof globalThis & {
+  [TENANT_GLOBAL_ENTITY_TYPES_KEY]?: Set<string>
+}
+
+function getTenantGlobalEntityTypes(): Set<string> {
+  const scope = globalThis as GlobalWithTenantGlobalEntityTypes
+  if (!scope[TENANT_GLOBAL_ENTITY_TYPES_KEY]) {
+    scope[TENANT_GLOBAL_ENTITY_TYPES_KEY] = new Set<string>(CORE_TENANT_GLOBAL_ENTITY_TYPES)
+  }
+  return scope[TENANT_GLOBAL_ENTITY_TYPES_KEY]
+}
+
+function normalize(entityType: string): string {
+  return String(entityType || '').trim()
+}
+
+/**
+ * Declare that an entity type outside this package is a platform-wide catalogue.
+ *
+ * Modules shipped as their own package — and apps with their own tenant-less
+ * catalogue tables — cannot be listed above, so they opt in here. Call it during
+ * module registration (a module's `di.ts` is the usual place), before any
+ * reindex job runs.
+ *
+ * Forgetting the call is safe in the only direction that matters: the entity
+ * type simply keeps failing closed, and `reindexEntity` logs a warning naming
+ * it, so the missing declaration is diagnosable from the log rather than from a
+ * cross-tenant search result.
+ */
+export function registerTenantGlobalEntityTypes(...entityTypes: string[]): void {
+  const tenantGlobalEntityTypes = getTenantGlobalEntityTypes()
+  for (const entityType of entityTypes) {
+    const normalized = normalize(entityType)
+    if (normalized) tenantGlobalEntityTypes.add(normalized)
+  }
+}
+
+/** Declaration intent only; runtime widening also requires physical verification in search-scope. */
+export function isTenantGlobalEntityType(entityType: string): boolean {
+  return getTenantGlobalEntityTypes().has(normalize(entityType))
+}
+
+/** The current allowlist, for diagnostics and tests. */
+export function listTenantGlobalEntityTypes(): string[] {
+  return Array.from(getTenantGlobalEntityTypes())
+}
+
+/** Test-only: drop every registration and restore this package's own entries. */
+export function resetTenantGlobalEntityTypes(): void {
+  const tenantGlobalEntityTypes = getTenantGlobalEntityTypes()
+  tenantGlobalEntityTypes.clear()
+  for (const entityType of CORE_TENANT_GLOBAL_ENTITY_TYPES) tenantGlobalEntityTypes.add(entityType)
+}

package/src/modules/query_index/subscribers/reindex.ts

@@ -2,10 +2,25 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
 import { recordIndexerLog } from '@open-mercato/shared/lib/indexers/status-log'
 import { reindexEntity } from '../lib/reindexer'
+import type { ReindexRefusalReason } from '../lib/reindexer'
 import type { VectorIndexService } from '@open-mercato/search/vector'
 import type { ProgressService } from '@open-mercato/core/modules/progress/lib/progressService'
 import { resolveQueryIndexReindexScope } from '../lib/subscriber-scope'
 
+/** Operator-facing text for a sweep that deliberately did no work. */
+const REINDEX_REFUSAL_MESSAGES: Record<ReindexRefusalReason, string> = {
+  'no-tenant-column':
+    'the source table has no tenant_id column and the entity type is not declared tenant-global. ' +
+    'Declare it with registerTenantGlobalEntityTypes() if it is a global catalogue.',
+  'column-probe-failed':
+    'the source table\'s columns could not be read, so no scope could be proven. This is usually ' +
+    'transient - retry the reindex.',
+  'declared-global-but-org-scoped':
+    'the entity type is declared tenant-global but its table carries an organization_id column. ' +
+    'A global projection requires a table with neither scope column; remove the declaration or ' +
+    'the column.',
+}
+
 export const metadata = { event: 'query_index.reindex', persistent: true }
 
 function forkReindexEntityManager(em: EntityManager): EntityManager {
@@ -167,12 +182,19 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
       { processed: result.processed, total: result.total },
       { complete: true },
     )
+    // A refused sweep is byte-identical to a successful zero-row one, so without this the
+    // status page - the one screen built to answer "why is this entity type not indexed" -
+    // reports a green completion with no stated reason. That undercuts the guard's own
+    // safety argument, which is that a missing declaration "shows up in the log".
     await recordIndexerLog(
       { em },
       {
         source: 'query_index',
         handler: 'event:query_index.reindex',
-        message: `Reindex completed for ${entityType}`,
+        level: result.refused ? 'warn' : undefined,
+        message: result.refused
+          ? `Reindex refused for ${entityType}: ${REINDEX_REFUSAL_MESSAGES[result.refused]}`
+          : `Reindex completed for ${entityType}`,
         entityType,
         tenantId: tenantId ?? null,
         organizationId: organizationId ?? null,
@@ -181,6 +203,7 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
           total: result.total,
           tenantScopes: result.tenantScopes,
           scopes: result.scopes,
+          ...(result.refused ? { refused: result.refused } : {}),
         },
       },
     )

package/src/modules/sales/components/documents/ItemsSection.tsx

@@ -6,7 +6,7 @@ import { apiCall, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/u
 import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
 import { deleteCrud } from "@open-mercato/ui/backend/utils/crud";
 import { normalizeCrudServerError } from "@open-mercato/ui/backend/utils/serverErrors";
-import { LoadingMessage, TabEmptyState } from "@open-mercato/ui/backend/detail";
+import { ErrorMessage, LoadingMessage, TabEmptyState } from "@open-mercato/ui/backend/detail";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { Pencil, Trash2 } from "lucide-react";
@@ -192,7 +192,7 @@ export function SalesDocumentItemsSection({
     kind !== "order",
   );
 
-  const { widgets: allColumnWidgets } = useInjectionDataWidgets(
+  const { widgets: allColumnWidgets, isLoading: injectedColumnsLoading, error: injectedColumnsError } = useInjectionDataWidgets(
     extensionPoints.hosts.orderItemColumns.spotId,
   );
   const columnWidgets = kind === "order" ? allColumnWidgets : [];
@@ -719,7 +719,10 @@ export function SalesDocumentItemsSection({
   return (
     <OrderItemsInjectionContext.Provider value={{ documentId, kind }}>
     <div className="space-y-4">
-      {loading ? (
+      {kind === "order" && injectedColumnsError ? (
+        <ErrorMessage label={t('ui.dataTable.extensions.error', 'Some table extensions could not load. Reload the page to retry.')} />
+      ) : null}
+      {loading || (kind === "order" && injectedColumnsLoading) ? (
         <LoadingMessage
           label={t("sales.documents.items.loading", "Loading items…")}
           className="border-0 bg-transparent p-0 py-8 justify-center"