@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/src/modules/customers/api/dictionaries/[kind]/route.ts

@@ -6,10 +6,17 @@ import type { CommandExecuteResult } from '@open-mercato/shared/lib/commands/typ
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import { CustomerDictionaryEntry, CustomerPipelineStage } from '../../../data/entities'
 import { ensureDictionaryEntry } from '../../../commands/shared'
-import { mapDictionaryKind, resolveDictionaryRouteContext } from '../context'
+import { mapDictionaryKind, resolveDictionaryActorId, resolveDictionaryRouteContext } from '../context'
 import { createDictionaryCacheKey, createDictionaryCacheTags, invalidateDictionaryCache, DICTIONARY_CACHE_TTL_MS } from '../cache'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { loadRoleTypeUsageMap, resolveRoleTypeUsageKey } from '../../../lib/roleTypeUsage'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 
 const colorSchema = z.string().trim().regex(/^#([0-9A-Fa-f]{6})$/, 'Invalid color hex')
 const iconSchema = z.string().trim().min(1).max(48)
@@ -21,6 +28,10 @@ const postSchema = z.object({
   icon: iconSchema.or(z.null()).optional(),
 })
 
+const querySchema = z.object({
+  organizationId: z.string().uuid().optional(),
+})
+
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },
   POST: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },
@@ -28,30 +39,45 @@ export const metadata = {
 
 export async function GET(req: Request, ctx: { params?: { kind?: string } }) {
   try {
-    const { translate, em, organizationId, tenantId, readableOrganizationIds, cache } = await resolveDictionaryRouteContext(req)
+    const url = new URL(req.url)
+    const query = querySchema.parse({
+      organizationId: url.searchParams.get('organizationId') ?? undefined,
+    })
+    const { translate, em, organizationId, readableOrganizationIds, tenantId, cache } = await resolveDictionaryRouteContext(req, {
+      selectedId: query.organizationId ?? undefined,
+    })
     const { mappedKind } = mapDictionaryKind(ctx.params?.kind)
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })
+    }
+    const scopedOrganizationIds = readableOrganizationIds.length > 0 ? readableOrganizationIds : [organizationId]
+    const canUseCache = Boolean(cache) && mappedKind !== 'person_company_role'
 
     let cacheKey: string | null = null
-    if (cache) {
-      cacheKey = createDictionaryCacheKey({ tenantId, organizationId, mappedKind, readableOrganizationIds })
+    if (canUseCache && cache) {
+      cacheKey = createDictionaryCacheKey({
+        tenantId,
+        organizationId,
+        mappedKind,
+        readableOrganizationIds: scopedOrganizationIds,
+      })
       const cached = await cache.get(cacheKey)
       if (cached) {
         return NextResponse.json(cached)
       }
     }
 
-    const organizationOrder = new Map<string, number>()
-    readableOrganizationIds.forEach((id, index) => organizationOrder.set(id, index))
-
-    const entries = await em.find(
+    const entries = await findWithDecryption(
+      em,
       CustomerDictionaryEntry,
-      { tenantId, organizationId: { $in: readableOrganizationIds }, kind: mappedKind } as any,
-      { orderBy: { label: 'asc' } }
+      { tenantId, kind: mappedKind, organizationId: { $in: scopedOrganizationIds } } as any,
+      { orderBy: { label: 'asc' } },
+      { tenantId, organizationId },
     )
 
     if (mappedKind === 'pipeline_stage' && organizationId) {
       const existingNormalized = new Set(entries.map((e) => e.normalizedValue))
-      const pipelineStages = await em.find(CustomerPipelineStage, { organizationId, tenantId })
+      const pipelineStages = await findWithDecryption(em, CustomerPipelineStage, { organizationId, tenantId }, {}, { tenantId, organizationId })
       for (const stage of pipelineStages) {
         if (!existingNormalized.has(stage.label.trim().toLowerCase())) {
           const created = await ensureDictionaryEntry(em, {
@@ -68,45 +94,89 @@ export async function GET(req: Request, ctx: { params?: { kind?: string } }) {
       }
     }
 
-    const byValue = new Map<string, { entry: CustomerDictionaryEntry; isInherited: boolean; order: number }>()
-    for (const entry of entries) {
-      const normalized = entry.normalizedValue
-      const order = organizationOrder.get(entry.organizationId) ?? Number.MAX_SAFE_INTEGER
-      if (!byValue.has(normalized) || order < byValue.get(normalized)!.order) {
-        byValue.set(normalized, {
-          entry,
-          isInherited: organizationId ? entry.organizationId !== organizationId : false,
-          order,
-        })
-      }
+    const inheritedPriority = new Map(scopedOrganizationIds.map((id, index) => [id, index]))
+    const sortByLabel = (left: CustomerDictionaryEntry, right: CustomerDictionaryEntry) =>
+      left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })
+
+    const localEntries = entries
+      .filter((entry) => entry.organizationId === organizationId)
+      .sort(sortByLabel)
+    const inheritedEntries = entries
+      .filter((entry) => entry.organizationId !== organizationId)
+      .sort((left, right) => {
+        const leftPriority = inheritedPriority.get(left.organizationId) ?? Number.MAX_SAFE_INTEGER
+        const rightPriority = inheritedPriority.get(right.organizationId) ?? Number.MAX_SAFE_INTEGER
+        if (leftPriority !== rightPriority) return leftPriority - rightPriority
+        return sortByLabel(left, right)
+      })
+
+    const preferredEntries = new Map<string, CustomerDictionaryEntry>()
+    for (const entry of [...localEntries, ...inheritedEntries]) {
+      const normalizedValue = entry.normalizedValue?.trim() || entry.value.trim().toLowerCase()
+      if (!normalizedValue || preferredEntries.has(normalizedValue)) continue
+      preferredEntries.set(normalizedValue, entry)
     }
 
-    const items = Array.from(byValue.values()).map(({ entry, isInherited, order }) => ({
-      id: entry.id,
-      value: entry.value,
-      label: entry.label,
-      color: entry.color,
-      icon: entry.icon,
-      organizationId: entry.organizationId,
-      isInherited,
-      __order: order,
-    }))
-
-    items.sort((a, b) => {
-      if (a.isInherited !== b.isInherited) return a.isInherited ? 1 : -1
-      if (a.__order !== b.__order) return a.__order - b.__order
-      return a.label.localeCompare(b.label, undefined, { sensitivity: 'base' })
-    })
+    const preferredEntryList = Array.from(preferredEntries.values())
+    const usageByEntryKey =
+      mappedKind === 'person_company_role'
+        ? await loadRoleTypeUsageMap(em, {
+            tenantId,
+            entries: preferredEntryList.map((entry) => ({
+              organizationId: entry.organizationId,
+              value: entry.value,
+            })),
+          })
+        : new Map()
+
+    const items = [
+      ...preferredEntryList
+        .filter((entry) => entry.organizationId === organizationId)
+        .sort(sortByLabel)
+        .map((entry) => ({
+          id: entry.id,
+          value: entry.value,
+          label: entry.label,
+          color: entry.color,
+          icon: entry.icon,
+          organizationId: entry.organizationId,
+          isInherited: false,
+          ...(mappedKind === 'person_company_role'
+            ? {
+                usageCount:
+                  usageByEntryKey.get(resolveRoleTypeUsageKey(entry.organizationId, entry.value))?.total ?? 0,
+              }
+            : {}),
+        })),
+      ...preferredEntryList
+        .filter((entry) => entry.organizationId !== organizationId)
+        .sort(sortByLabel)
+        .map((entry) => ({
+          id: entry.id,
+          value: entry.value,
+          label: entry.label,
+          color: entry.color,
+          icon: entry.icon,
+          organizationId: entry.organizationId,
+          isInherited: true,
+          ...(mappedKind === 'person_company_role'
+            ? {
+                usageCount:
+                  usageByEntryKey.get(resolveRoleTypeUsageKey(entry.organizationId, entry.value))?.total ?? 0,
+              }
+            : {}),
+        })),
+    ]
 
     const responseBody = {
-      items: items.map(({ __order, ...item }) => item),
+      items,
     }
 
-    if (cache && cacheKey) {
+    if (canUseCache && cache && cacheKey) {
       const tags = createDictionaryCacheTags({
         tenantId,
         mappedKind,
-        organizationIds: readableOrganizationIds,
+        organizationIds: scopedOrganizationIds,
       })
       try {
         await cache.set(cacheKey, responseBody, {
@@ -136,7 +206,22 @@ export async function POST(req: Request, ctx: { params?: { kind?: string } }) {
       throw new CrudHttpError(400, { error: context.translate('customers.errors.organization_required', 'Organization context is required') })
     }
     const { mappedKind } = mapDictionaryKind(ctx.params?.kind)
-    const body = postSchema.parse(await req.json().catch(() => ({})))
+    const body = postSchema.parse(await readJsonSafe(req, {}))
+    const guardUserId = resolveDictionaryActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.dictionary_entry',
+      resourceId: '',
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: body,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     const commandBus = (context.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } =
       (await commandBus.execute('customers.dictionaryEntries.create', {
@@ -151,7 +236,7 @@ export async function POST(req: Request, ctx: { params?: { kind?: string } }) {
         },
         ctx: context.ctx,
       })) as CommandExecuteResult<{ entryId: string; mode: 'created' | 'updated' | 'unchanged' }>
-    const entry = await context.em.fork().findOne(CustomerDictionaryEntry, result.entryId)
+    const entry = await findOneWithDecryption(context.em.fork(), CustomerDictionaryEntry, result.entryId, {}, { tenantId: context.tenantId, organizationId: context.organizationId })
     if (!entry) {
       throw new CrudHttpError(400, { error: context.translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') })
     }
@@ -162,6 +247,20 @@ export async function POST(req: Request, ctx: { params?: { kind?: string } }) {
       organizationIds: [entry.organizationId],
     })
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.dictionary_entry',
+        resourceId: entry.id,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     const response = NextResponse.json(
       {
         id: entry.id,
@@ -223,7 +322,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'List dictionary entries',
-      description: 'Returns the merged dictionary entries for the requested kind, including inherited values.',
+      description: 'Returns dictionary entries for the requested kind within the currently selected organization.',
       responses: [
         { status: 200, description: 'Dictionary entries', schema: dictionaryListResponseSchema },
         { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },

package/src/modules/customers/api/dictionaries/context.ts

@@ -9,7 +9,7 @@ import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CacheStrategy } from '@open-mercato/cache'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 
-export const dictionaryKindSchema = z.enum([
+const BUILTIN_DICTIONARY_ROUTE_KINDS = [
   'statuses',
   'sources',
   'lifecycle-stages',
@@ -19,21 +19,27 @@ export const dictionaryKindSchema = z.enum([
   'pipeline-stages',
   'job-titles',
   'industries',
+  'temperature',
+  'renewal-quarters',
+  'person-company-roles',
+] as const
+
+type BuiltinDictionaryRouteKind = (typeof BUILTIN_DICTIONARY_ROUTE_KINDS)[number]
+
+const dictionaryCustomKindSchema = z
+  .string()
+  .trim()
+  .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid dictionary kind')
+
+export const dictionaryKindSchema = z.union([
+  z.enum(BUILTIN_DICTIONARY_ROUTE_KINDS),
+  dictionaryCustomKindSchema,
 ])
 
 export type DictionaryRouteParam = z.infer<typeof dictionaryKindSchema>
-export type DictionaryEntityKind =
-  | 'status'
-  | 'source'
-  | 'lifecycle_stage'
-  | 'address_type'
-  | 'activity_type'
-  | 'deal_status'
-  | 'pipeline_stage'
-  | 'job_title'
-  | 'industry'
-
-const KIND_MAP: Record<DictionaryRouteParam, DictionaryEntityKind> = {
+export type DictionaryEntityKind = string
+
+const KIND_MAP: Record<BuiltinDictionaryRouteKind, DictionaryEntityKind> = {
   statuses: 'status',
   sources: 'source',
   'lifecycle-stages': 'lifecycle_stage',
@@ -43,6 +49,9 @@ const KIND_MAP: Record<DictionaryRouteParam, DictionaryEntityKind> = {
   'pipeline-stages': 'pipeline_stage',
   'job-titles': 'job_title',
   industries: 'industry',
+  temperature: 'temperature',
+  'renewal-quarters': 'renewal_quarter',
+  'person-company-roles': 'person_company_role',
 }
 
 export const paramsSchema = z.object({
@@ -61,15 +70,30 @@ export type DictionaryRouteContext = {
   ctx: CommandRuntimeContext
 }
 
+export function resolveDictionaryActorId(
+  auth: Awaited<ReturnType<typeof getAuthFromRequest>>,
+): string {
+  if (auth && typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub
+  if (auth && typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId
+  if (auth && typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId
+  return 'system'
+}
+
 export function mapDictionaryKind(kind: string | undefined) {
   const parsed = paramsSchema.parse({ kind })
+  const mappedKind = Object.prototype.hasOwnProperty.call(KIND_MAP, parsed.kind)
+    ? KIND_MAP[parsed.kind as BuiltinDictionaryRouteKind]
+    : parsed.kind
   return {
     kind: parsed.kind,
-    mappedKind: KIND_MAP[parsed.kind],
+    mappedKind,
   }
 }
 
-export async function resolveDictionaryRouteContext(req: Request): Promise<DictionaryRouteContext> {
+export async function resolveDictionaryRouteContext(
+  req: Request,
+  options?: { selectedId?: string | null },
+): Promise<DictionaryRouteContext> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   const { translate } = await resolveTranslations()
@@ -77,7 +101,12 @@ export async function resolveDictionaryRouteContext(req: Request): Promise<Dicti
     throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })
   }
 
-  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const scope = await resolveOrganizationScopeForRequest({
+    container,
+    auth,
+    request: req,
+    selectedId: options?.selectedId,
+  })
   const em = (container.resolve('em') as EntityManager)
   const tenantId = scope?.tenantId ?? auth.tenantId
   const organizationId = scope?.selectedId ?? auth.orgId ?? null

package/src/modules/customers/api/dictionaries/kind-settings/route.ts

@@ -0,0 +1,232 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { TableNotFoundException } from '@mikro-orm/core'
+import { CustomerDictionaryKindSetting } from '../../../data/entities'
+import { resolveDictionaryRouteContext } from '../context'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import { resolveAuthActorId } from '@open-mercato/core/modules/customers/lib/interactionRequestContext'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import {
+  customerKindSettingsUpsertSchema,
+  type CustomerKindSettingsUpsertInput,
+} from '../../../data/validators'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },
+  PATCH: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },
+}
+
+const querySchema = z.object({
+  organizationId: z.string().uuid().optional(),
+})
+
+function isMissingKindSettingsTable(error: unknown): boolean {
+  if (error instanceof TableNotFoundException) {
+    return true
+  }
+  if (typeof error !== 'object' || error === null) {
+    return false
+  }
+  const candidate = error as { code?: unknown; message?: unknown }
+  return candidate.code === '42P01'
+    || (typeof candidate.message === 'string'
+      && candidate.message.includes('customer_dictionary_kind_settings')
+      && candidate.message.includes('does not exist'))
+}
+
+export async function GET(req: Request) {
+  const { translate } = await resolveTranslations()
+  try {
+    const url = new URL(req.url)
+    const query = querySchema.parse({
+      organizationId: url.searchParams.get('organizationId') ?? undefined,
+    })
+    const context = await resolveDictionaryRouteContext(req, {
+      selectedId: query.organizationId ?? undefined,
+    })
+    const em = context.em
+
+    const settings = await findWithDecryption(
+      em,
+      CustomerDictionaryKindSetting,
+      {
+        tenantId: context.tenantId,
+        ...(context.organizationId ? { organizationId: context.organizationId } : {}),
+      },
+      { orderBy: { sortOrder: 'asc', kind: 'asc' } },
+      { tenantId: context.tenantId, organizationId: context.organizationId ?? null },
+    )
+
+    return NextResponse.json({
+      items: settings.map((s) => ({
+        id: s.id,
+        kind: s.kind,
+        selectionMode: s.selectionMode,
+        visibleInTags: s.visibleInTags,
+        sortOrder: s.sortOrder,
+      })),
+    })
+  } catch (err) {
+    if (isMissingKindSettingsTable(err)) {
+      return NextResponse.json({ items: [] })
+    }
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    console.error('[customers/dictionaries/kind-settings.GET]', err)
+    return NextResponse.json({ error: translate('customers.errors.kind_settings_load_failed', 'Failed to load kind settings') }, { status: 500 })
+  }
+}
+
+const patchSchema = z.object({
+  kind: z.string().trim().min(1).max(100),
+  selectionMode: z.enum(['single', 'multi']).optional(),
+  visibleInTags: z.boolean().optional(),
+  sortOrder: z.number().int().min(0).optional(),
+})
+
+export async function PATCH(req: Request) {
+  const { translate } = await resolveTranslations()
+  try {
+    const context = await resolveDictionaryRouteContext(req)
+    if (!context.organizationId) {
+      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })
+    }
+    const payload = patchSchema.parse(await readJsonSafe(req, {}))
+    const guardUserId = resolveAuthActorId(context.auth!)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.settings',
+      resourceId: context.organizationId,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    const commandInput: CustomerKindSettingsUpsertInput = customerKindSettingsUpsertSchema.parse({
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      kind: payload.kind,
+      selectionMode: payload.selectionMode,
+      visibleInTags: payload.visibleInTags,
+      sortOrder: payload.sortOrder,
+    })
+
+    const commandBus = context.container.resolve('commandBus') as CommandBus
+    const { result, logEntry } = await commandBus.execute<
+      CustomerKindSettingsUpsertInput,
+      {
+        settingId: string
+        created: boolean
+        kind: string
+        selectionMode: string
+        visibleInTags: boolean
+        sortOrder: number
+      }
+    >('customers.dictionaryKindSettings.upsert', {
+      input: commandInput,
+      ctx: context.ctx,
+    })
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.settings',
+        resourceId: context.organizationId,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
+    const response = NextResponse.json({
+      id: result.settingId,
+      kind: result.kind,
+      selectionMode: result.selectionMode,
+      visibleInTags: result.visibleInTags,
+      sortOrder: result.sortOrder,
+    })
+    if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+      response.headers.set(
+        'x-om-operation',
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? 'customers.dictionaryKindSetting',
+          resourceId: logEntry.resourceId ?? result.settingId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),
+        }),
+      )
+    }
+    return response
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    console.error('[customers/dictionaries/kind-settings.PATCH]', err)
+    return NextResponse.json({ error: 'Failed to update kind setting' }, { status: 500 })
+  }
+}
+
+const kindSettingSchema = z.object({
+  id: z.string().uuid(),
+  kind: z.string(),
+  selectionMode: z.enum(['single', 'multi']),
+  visibleInTags: z.boolean(),
+  sortOrder: z.number(),
+})
+
+const kindSettingsListSchema = z.object({
+  items: z.array(kindSettingSchema),
+})
+
+const errorSchema = z.object({ error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Customer dictionary kind settings',
+  methods: {
+    GET: {
+      summary: 'List kind settings',
+      description: 'Returns selection mode and visibility settings for each dictionary kind.',
+      responses: [
+        { status: 200, description: 'Kind settings', schema: kindSettingsListSchema },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+      ],
+    },
+    PATCH: {
+      summary: 'Update kind setting',
+      description: 'Creates or updates settings for a specific dictionary kind.',
+      requestBody: { contentType: 'application/json', schema: patchSchema },
+      responses: [
+        { status: 200, description: 'Setting updated', schema: kindSettingSchema },
+      ],
+      errors: [
+        { status: 400, description: 'Invalid payload', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+      ],
+    },
+  },
+}