@open-mercato/core 0.6.7-develop.6593.1.0ecf630f1e → 0.6.7-develop.6594.1.5581f765f4

package/dist/modules/auth/api/features.js

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { getModules } from "@open-mercato/shared/lib/i18n/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { synthesizeRestrictedEntityFeatures } from "@open-mercato/core/modules/entities/lib/restrictedEntityFeatures";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["auth.acl.manage"] }
 };
@@ -33,6 +35,18 @@ async function GET(req) {
       return base;
     })
   );
+  try {
+    const { resolve } = await createRequestContainer();
+    const em = resolve("em");
+    const synthesized = await synthesizeRestrictedEntityFeatures(em, auth.tenantId ?? null);
+    for (const item of synthesized) {
+      const deps = normalizeDependsOn(item.dependsOn);
+      const base = { id: item.id, title: item.title, module: item.module };
+      if (deps) base.dependsOn = deps;
+      items.push(base);
+    }
+  } catch {
+  }
   const byId = /* @__PURE__ */ new Map();
   for (const it of items) if (!byId.has(it.id)) byId.set(it.id, it);
   const list = Array.from(byId.values()).sort((a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id));

package/dist/modules/auth/api/features.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/features.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\ntype FeatureItem = {\n  id: string\n  title: string\n  module: string\n  dependsOn?: string[]\n}\n\nfunction normalizeDependsOn(value: unknown): string[] | undefined {\n  if (!Array.isArray(value)) return undefined\n  const out: string[] = []\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue\n    const trimmed = entry.trim()\n    if (!trimmed) continue\n    out.push(trimmed)\n  }\n  if (out.length === 0) return undefined\n  return Array.from(new Set(out))\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const modules = getModules()\n  const items: FeatureItem[] = (modules || []).flatMap((m: any) =>\n    (m.features || []).map((f: any) => {\n      const deps = normalizeDependsOn(f?.dependsOn)\n      const base: FeatureItem = {\n        id: String(f.id),\n        title: String(f.title || f.id),\n        module: String(f.module || m.id),\n      }\n      if (deps) base.dependsOn = deps\n      return base\n    })\n  )\n  // Deduplicate by id (keep first occurrence)\n  const byId = new Map<string, FeatureItem>()\n  for (const it of items) if (!byId.has(it.id)) byId.set(it.id, it)\n  const list = Array.from(byId.values()).sort((a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id))\n\n  // Build module info map\n  const moduleInfo = new Map<string, { id: string; title: string }>()\n  for (const m of modules) {\n    if (m.id) {\n      moduleInfo.set(m.id, { id: m.id, title: (m.info as any)?.title || m.id })\n    }\n  }\n\n  return NextResponse.json({ items: list, modules: Array.from(moduleInfo.values()) })\n}\n\nconst featureItemSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n  module: z.string(),\n  dependsOn: z.array(z.string()).optional(),\n})\n\nconst featureModuleSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n})\n\nconst featuresResponseSchema = z.object({\n  items: z.array(featureItemSchema),\n  modules: z.array(featureModuleSchema),\n})\n\nconst featuresMethodDoc: OpenApiMethodDoc = {\n  summary: 'List declared feature flags',\n  description: 'Returns all static features contributed by the enabled modules along with their module source.',\n  tags: ['Authentication & Accounts'],\n  responses: [\n    {\n      status: 200,\n      description: 'Aggregated feature catalog',\n      schema: featuresResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 401,\n      description: 'Missing authentication',\n      schema: z.object({ error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List declared feature flags',\n  methods: {\n    GET: featuresMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAEpB,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AASA,SAAS,mBAAmB,OAAsC;AAChE,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,OAAO;AAAA,EAClB;AACA,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,SAAO,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAChC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,UAAU,WAAW;AAC3B,QAAM,SAAwB,WAAW,CAAC,GAAG;AAAA,IAAQ,CAAC,OACnD,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,MAAW;AACjC,YAAM,OAAO,mBAAmB,GAAG,SAAS;AAC5C,YAAM,OAAoB;AAAA,QACxB,IAAI,OAAO,EAAE,EAAE;AAAA,QACf,OAAO,OAAO,EAAE,SAAS,EAAE,EAAE;AAAA,QAC7B,QAAQ,OAAO,EAAE,UAAU,EAAE,EAAE;AAAA,MACjC;AACA,UAAI,KAAM,MAAK,YAAY;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,oBAAI,IAAyB;AAC1C,aAAW,MAAM,MAAO,KAAI,CAAC,KAAK,IAAI,GAAG,EAAE,EAAG,MAAK,IAAI,GAAG,IAAI,EAAE;AAChE,QAAM,OAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAGlH,QAAM,aAAa,oBAAI,IAA2C;AAClE,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,IAAI;AACR,iBAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,OAAQ,EAAE,MAAc,SAAS,EAAE,GAAG,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO,CAAC,EAAE,CAAC;AACpF;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC1C,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,SAAS,EAAE,MAAM,mBAAmB;AACtC,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { getModules } from '@open-mercato/shared/lib/i18n/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { synthesizeRestrictedEntityFeatures } from '@open-mercato/core/modules/entities/lib/restrictedEntityFeatures'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\ntype FeatureItem = {\n  id: string\n  title: string\n  module: string\n  dependsOn?: string[]\n}\n\nfunction normalizeDependsOn(value: unknown): string[] | undefined {\n  if (!Array.isArray(value)) return undefined\n  const out: string[] = []\n  for (const entry of value) {\n    if (typeof entry !== 'string') continue\n    const trimmed = entry.trim()\n    if (!trimmed) continue\n    out.push(trimmed)\n  }\n  if (out.length === 0) return undefined\n  return Array.from(new Set(out))\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const modules = getModules()\n  const items: FeatureItem[] = (modules || []).flatMap((m: any) =>\n    (m.features || []).map((f: any) => {\n      const deps = normalizeDependsOn(f?.dependsOn)\n      const base: FeatureItem = {\n        id: String(f.id),\n        title: String(f.title || f.id),\n        module: String(f.module || m.id),\n      }\n      if (deps) base.dependsOn = deps\n      return base\n    })\n  )\n  // Append synthesized per-entity features for the tenant's restricted custom\n  // entities so they can be granted in the ACL editor. Tenant-scoped; never\n  // throws (falls back to the static catalog on any failure).\n  try {\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const synthesized = await synthesizeRestrictedEntityFeatures(em, auth.tenantId ?? null)\n    for (const item of synthesized) {\n      const deps = normalizeDependsOn(item.dependsOn)\n      const base: FeatureItem = { id: item.id, title: item.title, module: item.module }\n      if (deps) base.dependsOn = deps\n      items.push(base)\n    }\n  } catch {}\n\n  // Deduplicate by id (keep first occurrence)\n  const byId = new Map<string, FeatureItem>()\n  for (const it of items) if (!byId.has(it.id)) byId.set(it.id, it)\n  const list = Array.from(byId.values()).sort((a, b) => a.module.localeCompare(b.module) || a.id.localeCompare(b.id))\n\n  // Build module info map\n  const moduleInfo = new Map<string, { id: string; title: string }>()\n  for (const m of modules) {\n    if (m.id) {\n      moduleInfo.set(m.id, { id: m.id, title: (m.info as any)?.title || m.id })\n    }\n  }\n\n  return NextResponse.json({ items: list, modules: Array.from(moduleInfo.values()) })\n}\n\nconst featureItemSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n  module: z.string(),\n  dependsOn: z.array(z.string()).optional(),\n})\n\nconst featureModuleSchema = z.object({\n  id: z.string(),\n  title: z.string(),\n})\n\nconst featuresResponseSchema = z.object({\n  items: z.array(featureItemSchema),\n  modules: z.array(featureModuleSchema),\n})\n\nconst featuresMethodDoc: OpenApiMethodDoc = {\n  summary: 'List declared feature flags',\n  description: 'Returns all static features contributed by the enabled modules along with their module source.',\n  tags: ['Authentication & Accounts'],\n  responses: [\n    {\n      status: 200,\n      description: 'Aggregated feature catalog',\n      schema: featuresResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 401,\n      description: 'Missing authentication',\n      schema: z.object({ error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List declared feature flags',\n  methods: {\n    GET: featuresMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AACvC,SAAS,0CAA0C;AAE5C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AASA,SAAS,mBAAmB,OAAsC;AAChE,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,QAAI,KAAK,OAAO;AAAA,EAClB;AACA,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,SAAO,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAChC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,UAAU,WAAW;AAC3B,QAAM,SAAwB,WAAW,CAAC,GAAG;AAAA,IAAQ,CAAC,OACnD,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,MAAW;AACjC,YAAM,OAAO,mBAAmB,GAAG,SAAS;AAC5C,YAAM,OAAoB;AAAA,QACxB,IAAI,OAAO,EAAE,EAAE;AAAA,QACf,OAAO,OAAO,EAAE,SAAS,EAAE,EAAE;AAAA,QAC7B,QAAQ,OAAO,EAAE,UAAU,EAAE,EAAE;AAAA,MACjC;AACA,UAAI,KAAM,MAAK,YAAY;AAC3B,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAIA,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,cAAc,MAAM,mCAAmC,IAAI,KAAK,YAAY,IAAI;AACtF,eAAW,QAAQ,aAAa;AAC9B,YAAM,OAAO,mBAAmB,KAAK,SAAS;AAC9C,YAAM,OAAoB,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAChF,UAAI,KAAM,MAAK,YAAY;AAC3B,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF,QAAQ;AAAA,EAAC;AAGT,QAAM,OAAO,oBAAI,IAAyB;AAC1C,aAAW,MAAM,MAAO,KAAI,CAAC,KAAK,IAAI,GAAG,EAAE,EAAG,MAAK,IAAI,GAAG,IAAI,EAAE;AAChE,QAAM,OAAO,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAGlH,QAAM,aAAa,oBAAI,IAA2C;AAClE,aAAW,KAAK,SAAS;AACvB,QAAI,EAAE,IAAI;AACR,iBAAW,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,OAAQ,EAAE,MAAc,SAAS,EAAE,GAAG,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,EAAE,OAAO,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO,CAAC,EAAE,CAAC;AACpF;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAAA,EAChB,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAC1C,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,IAAI,EAAE,OAAO;AAAA,EACb,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAChC,SAAS,EAAE,MAAM,mBAAmB;AACtC,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/entities/api/entities.js

@@ -55,6 +55,7 @@ async function GET(req) {
     labelField: c.labelField ?? void 0,
     defaultEditor: c.defaultEditor ?? void 0,
     showInSidebar: c.showInSidebar ?? false,
+    accessRestricted: c.accessRestricted ?? false,
     updatedAt: c.updatedAt instanceof Date ? c.updatedAt.toISOString() : c.updatedAt ?? void 0
   }));
   const byId = /* @__PURE__ */ new Map();
@@ -97,6 +98,7 @@ async function POST(req) {
     return NextResponse.json({ error: "Validation failed", details: parsed.error.flatten() }, { status: 400 });
   }
   const input = parsed.data;
+  const accessRestrictedExplicit = body != null && typeof body === "object" && Object.prototype.hasOwnProperty.call(body, "accessRestricted");
   const container = await createRequestContainer();
   const { resolve } = container;
   const em = resolve("em");
@@ -133,6 +135,7 @@ async function POST(req) {
     mutationPayload: input
   });
   if (guard.blockedResponse) return guard.blockedResponse;
+  const isCreate = !ent;
   if (!ent) ent = em.create(CustomEntity, { ...where, createdAt: /* @__PURE__ */ new Date() });
   ent.label = input.label;
   ent.description = input.description ?? null;
@@ -140,6 +143,22 @@ async function POST(req) {
   ent.labelField = input.labelField ?? ent.labelField ?? null;
   ent.defaultEditor = input.defaultEditor ?? ent.defaultEditor ?? null;
   ent.showInSidebar = input.showInSidebar ?? ent.showInSidebar ?? false;
+  if (accessRestrictedExplicit) {
+    ent.accessRestricted = input.accessRestricted === true;
+  } else if (isCreate) {
+    let policyDefault = false;
+    try {
+      const moduleConfigService = resolve("moduleConfigService");
+      policyDefault = await moduleConfigService.getValue("entities", "newEntitiesRestrictedByDefault", {
+        defaultValue: false,
+        scope: { tenantId: auth.tenantId ?? null }
+      }) === true;
+    } catch {
+    }
+    ent.accessRestricted = policyDefault;
+  } else {
+    ent.accessRestricted = ent.accessRestricted ?? false;
+  }
   ent.updatedAt = /* @__PURE__ */ new Date();
   em.persist(ent);
   await em.flush();
@@ -203,6 +222,7 @@ const entitySummarySchema = z.object({
   labelField: z.string().optional(),
   defaultEditor: z.string().optional(),
   showInSidebar: z.boolean().optional(),
+  accessRestricted: z.boolean().optional(),
   updatedAt: z.string().optional(),
   count: z.number()
 });

package/dist/modules/entities/api/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/entities.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CustomEntity, CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/system-entities'\nimport { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  beginEntitiesMutationGuard,\n  ENTITY_DEFINITION_RESOURCE_KIND,\n} from './definitions.mutation-guard'\n\nconst CUSTOM_ENTITY_DEFINITION_RESOURCE_KIND = ENTITY_DEFINITION_RESOURCE_KIND\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n\n  // Generated entities from code\n  const AllEntities = getEntityIds()\n  const generated: { entityId: string; source: 'code'; label: string }[] = []\n  for (const modId of Object.keys(AllEntities)) {\n    const entities = (AllEntities as any)[modId] as Record<string, string>\n    for (const k of Object.keys(entities)) {\n      const id = entities[k]\n      if (!isSystemEntitySelectable(id)) continue\n      generated.push({ entityId: id, source: 'code', label: id })\n    }\n  }\n\n  // Custom user-defined entities (global/org/tenant scoped)\n  const where: any = { isActive: true }\n  where.$and = [\n    { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] },\n    { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n  ]\n  const customs = await em.find(CustomEntity as any, where as any, { orderBy: { entityId: 'asc' } as any })\n  // Resolve overlay precedence: prefer organization/tenant-specific over global\n  const customByEntityId = new Map<string, any>()\n  for (const c of customs as any[]) {\n    const specificity = (c.organizationId ? 2 : 0) + (c.tenantId ? 1 : 0)\n    const prev = customByEntityId.get(c.entityId)\n    const prevSpec = prev ? ((prev.organizationId ? 2 : 0) + (prev.tenantId ? 1 : 0)) : -1\n    if (!prev || specificity > prevSpec) customByEntityId.set(c.entityId, c)\n  }\n\n  const custom = Array.from(customByEntityId.values())\n    .filter((c) => isSystemEntitySelectable(c.entityId))\n    .map((c) => ({\n      entityId: c.entityId,\n      source: 'custom' as const,\n      label: c.label,\n      description: c.description ?? undefined,\n      labelField: (c as any).labelField ?? undefined,\n      defaultEditor: (c as any).defaultEditor ?? undefined,\n      showInSidebar: (c as any).showInSidebar ?? false,\n      updatedAt: c.updatedAt instanceof Date ? c.updatedAt.toISOString() : (c.updatedAt ?? undefined),\n    }))\n\n  const byId = new Map<string, any>()\n  for (const g of generated) byId.set(g.entityId, g)\n  for (const cu of custom) {\n    const existing = byId.get(cu.entityId)\n    byId.set(cu.entityId, { ...existing, ...cu, source: existing?.source ?? cu.source })\n  }\n\n  // Count field definitions scoped to current tenant/org (same scoping as custom entities)\n  const defsWhere: any = { isActive: true }\n  defsWhere.$and = [\n    //{ $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant\n    { tenantId: auth.tenantId ?? undefined as any },\n  ]\n  const defs = await em.find(CustomFieldDef as any, defsWhere as any)\n  // Count distinct field names (keys) per entityId\n  const keySets = new Map<string, Set<string>>()\n  for (const d of defs as any[]) {\n    const eid = String(d.entityId)\n    const k = String(d.key)\n    if (!isSystemEntitySelectable(eid)) continue\n    const set = keySets.get(eid) || new Set<string>()\n    set.add(k)\n    keySets.set(eid, set)\n  }\n  const counts: Record<string, number> = {}\n  for (const [eid, set] of keySets.entries()) counts[eid] = set.size\n\n  const items = Array.from(byId.values()).map((it: any) => ({ ...it, count: counts[it.entityId] || 0 }))\n  return NextResponse.json({ items })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = upsertCustomEntitySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const input = parsed.data\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n\n  // A registration for a module-declared, table-backed system entity would flip\n  // query-engine classification to doc storage for the whole entity type (#2939's\n  // failure mode via another door) \u2014 refuse to create one.\n  if (isOrmBackedSystemEntityId(em, input.entityId)) {\n    return NextResponse.json(\n      { error: 'System entities cannot be registered as custom entities', code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, entityId: input.entityId },\n      { status: 400 },\n    )\n  }\n\n  const where: any = { entityId: input.entityId, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }\n  let ent = await em.findOne(CustomEntity, where)\n  if (ent) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_DEFINITION_RESOURCE_KIND,\n        resourceId: ent.id,\n        current: ent.updatedAt ?? null,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n  }\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: ENTITY_DEFINITION_RESOURCE_KIND,\n    resourceId: ent ? ent.id : input.entityId,\n    operation: ent ? 'update' : 'create',\n    mutationPayload: input as unknown as Record<string, unknown>,\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  if (!ent) ent = em.create(CustomEntity, { ...where, createdAt: new Date() })\n  ent.label = input.label\n  ent.description = input.description ?? null\n  ent.isActive = input.isActive ?? true\n  ent.labelField = input.labelField ?? ent.labelField ?? null\n  ent.defaultEditor = input.defaultEditor ?? ent.defaultEditor ?? null\n  ent.showInSidebar = input.showInSidebar ?? ent.showInSidebar ?? false\n  ent.updatedAt = new Date()\n  em.persist(ent)\n  await em.flush()\n  await guard.runAfterSuccess()\n  // Invalidate sidebar/nav cache for tenant scope (also when tenantId is null)\n  try {\n    const cache = (await createRequestContainer()).resolve('cache') as any\n    if (cache) {\n      await cache.deleteByTags([`nav:entities:${auth.tenantId || 'null'}`])\n    }\n  } catch {}\n  return NextResponse.json({ ok: true, item: { id: ent.id, entityId: ent.entityId, label: ent.label, description: ent.description ?? undefined } })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const entityId = body?.entityId\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n\n  const where: any = { entityId, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }\n  const ent = await em.findOne(CustomEntity, where)\n  if (!ent) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: ENTITY_DEFINITION_RESOURCE_KIND,\n    resourceId: ent.id,\n    operation: 'delete',\n    mutationPayload: { entityId },\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  ent.isActive = false\n  ent.updatedAt = new Date()\n  ent.deletedAt = ent.deletedAt ?? new Date()\n  em.persist(ent)\n  await em.flush()\n  await guard.runAfterSuccess()\n  // Invalidate sidebar/nav cache for tenant scope (also when tenantId is null)\n  try {\n    const cache = (await createRequestContainer()).resolve('cache') as any\n    if (cache) {\n      await cache.deleteByTags([`nav:entities:${auth.tenantId || 'null'}`])\n    }\n  } catch {}\n  return NextResponse.json({ ok: true })\n}\n\nconst entitySummarySchema = z.object({\n  entityId: z.string(),\n  source: z.enum(['code', 'custom']),\n  label: z.string(),\n  description: z.string().optional(),\n  labelField: z.string().optional(),\n  defaultEditor: z.string().optional(),\n  showInSidebar: z.boolean().optional(),\n  updatedAt: z.string().optional(),\n  count: z.number(),\n})\n\nconst entityListResponseSchema = z.object({\n  items: z.array(entitySummarySchema),\n})\n\nconst deleteEntityRequestSchema = z.object({\n  entityId: z.string(),\n})\n\nconst upsertCustomEntityResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string().uuid(),\n    entityId: z.string(),\n    label: z.string(),\n    description: z.string().optional(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage custom entities',\n  methods: {\n    GET: {\n      summary: 'List available entities',\n      description: 'Returns generated and custom entities scoped to the caller with field counts per entity.',\n      responses: [\n        {\n          status: 200,\n          description: 'List of entities',\n          schema: entityListResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Upsert custom entity',\n      description: 'Creates or updates a tenant/org scoped custom entity definition.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: upsertCustomEntitySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Entity saved',\n          schema: upsertCustomEntityResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation error',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft delete custom entity',\n      description: 'Marks the specified custom entity inactive within the current scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteEntityRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Entity deleted',\n          schema: z.object({ ok: z.boolean() }),\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Entity not found in scope',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,cAAc,sBAAsB;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,SAAS,gCAAgC;AACzC,SAAS,oCAAoC,iCAAiC;AAC9E,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,yCAAyC;AAExC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEvI,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AAGvB,QAAM,cAAc,aAAa;AACjC,QAAM,YAAmE,CAAC;AAC1E,aAAW,SAAS,OAAO,KAAK,WAAW,GAAG;AAC5C,UAAM,WAAY,YAAoB,KAAK;AAC3C,eAAW,KAAK,OAAO,KAAK,QAAQ,GAAG;AACrC,YAAM,KAAK,SAAS,CAAC;AACrB,UAAI,CAAC,yBAAyB,EAAE,EAAG;AACnC,gBAAU,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,QAAa,EAAE,UAAU,KAAK;AACpC,QAAM,OAAO;AAAA,IACX,EAAE,KAAK,CAAE,EAAE,gBAAgB,KAAK,SAAS,OAAiB,GAAG,EAAE,gBAAgB,KAAK,CAAE,EAAE;AAAA,IACxF,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,EACjF;AACA,QAAM,UAAU,MAAM,GAAG,KAAK,cAAqB,OAAc,EAAE,SAAS,EAAE,UAAU,MAAM,EAAS,CAAC;AAExG,QAAM,mBAAmB,oBAAI,IAAiB;AAC9C,aAAW,KAAK,SAAkB;AAChC,UAAM,eAAe,EAAE,iBAAiB,IAAI,MAAM,EAAE,WAAW,IAAI;AACnE,UAAM,OAAO,iBAAiB,IAAI,EAAE,QAAQ;AAC5C,UAAM,WAAW,QAAS,KAAK,iBAAiB,IAAI,MAAM,KAAK,WAAW,IAAI,KAAM;AACpF,QAAI,CAAC,QAAQ,cAAc,SAAU,kBAAiB,IAAI,EAAE,UAAU,CAAC;AAAA,EACzE;AAEA,QAAM,SAAS,MAAM,KAAK,iBAAiB,OAAO,CAAC,EAChD,OAAO,CAAC,MAAM,yBAAyB,EAAE,QAAQ,CAAC,EAClD,IAAI,CAAC,OAAO;AAAA,IACX,UAAU,EAAE;AAAA,IACZ,QAAQ;AAAA,IACR,OAAO,EAAE;AAAA,IACT,aAAa,EAAE,eAAe;AAAA,IAC9B,YAAa,EAAU,cAAc;AAAA,IACrC,eAAgB,EAAU,iBAAiB;AAAA,IAC3C,eAAgB,EAAU,iBAAiB;AAAA,IAC3C,WAAW,EAAE,qBAAqB,OAAO,EAAE,UAAU,YAAY,IAAK,EAAE,aAAa;AAAA,EACvF,EAAE;AAEJ,QAAM,OAAO,oBAAI,IAAiB;AAClC,aAAW,KAAK,UAAW,MAAK,IAAI,EAAE,UAAU,CAAC;AACjD,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,KAAK,IAAI,GAAG,QAAQ;AACrC,SAAK,IAAI,GAAG,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI,QAAQ,UAAU,UAAU,GAAG,OAAO,CAAC;AAAA,EACrF;AAGA,QAAM,YAAiB,EAAE,UAAU,KAAK;AACxC,YAAU,OAAO;AAAA;AAAA,IAEf,EAAE,UAAU,KAAK,YAAY,OAAiB;AAAA,EAChD;AACA,QAAM,OAAO,MAAM,GAAG,KAAK,gBAAuB,SAAgB;AAElE,QAAM,UAAU,oBAAI,IAAyB;AAC7C,aAAW,KAAK,MAAe;AAC7B,UAAM,MAAM,OAAO,EAAE,QAAQ;AAC7B,UAAM,IAAI,OAAO,EAAE,GAAG;AACtB,QAAI,CAAC,yBAAyB,GAAG,EAAG;AACpC,UAAM,MAAM,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAY;AAChD,QAAI,IAAI,CAAC;AACT,YAAQ,IAAI,KAAK,GAAG;AAAA,EACtB;AACA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,KAAK,GAAG,KAAK,QAAQ,QAAQ,EAAG,QAAO,GAAG,IAAI,IAAI;AAE9D,QAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAa,EAAE,GAAG,IAAI,OAAO,OAAO,GAAG,QAAQ,KAAK,EAAE,EAAE;AACrG,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,QAAM,QAAQ,OAAO;AAErB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AAKvB,MAAI,0BAA0B,IAAI,MAAM,QAAQ,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2DAA2D,MAAM,oCAAoC,UAAU,MAAM,SAAS;AAAA,MACvI,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,QAAa,EAAE,UAAU,MAAM,UAAU,gBAAgB,KAAK,SAAS,MAAM,UAAU,KAAK,YAAY,KAAK;AACnH,MAAI,MAAM,MAAM,GAAG,QAAQ,cAAc,KAAK;AAC9C,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,MAAM,IAAI,KAAK,MAAM;AAAA,IACjC,WAAW,MAAM,WAAW;AAAA,IAC5B,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,CAAC,IAAK,OAAM,GAAG,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC3E,MAAI,QAAQ,MAAM;AAClB,MAAI,cAAc,MAAM,eAAe;AACvC,MAAI,WAAW,MAAM,YAAY;AACjC,MAAI,aAAa,MAAM,cAAc,IAAI,cAAc;AACvD,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,iBAAiB;AAChE,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,iBAAiB;AAChE,MAAI,YAAY,oBAAI,KAAK;AACzB,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAE5B,MAAI;AACF,UAAM,SAAS,MAAM,uBAAuB,GAAG,QAAQ,OAAO;AAC9D,QAAI,OAAO;AACT,YAAM,MAAM,aAAa,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,IAAI,IAAI,IAAI,UAAU,IAAI,UAAU,OAAO,IAAI,OAAO,aAAa,IAAI,eAAe,OAAU,EAAE,CAAC;AAClJ;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AAEvB,QAAM,QAAa,EAAE,UAAU,gBAAgB,KAAK,SAAS,MAAM,UAAU,KAAK,YAAY,KAAK;AACnG,QAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,KAAK;AAChD,MAAI,CAAC,IAAK,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1E,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,iBAAiB,EAAE,SAAS;AAAA,EAC9B,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,WAAW;AACf,MAAI,YAAY,oBAAI,KAAK;AACzB,MAAI,YAAY,IAAI,aAAa,oBAAI,KAAK;AAC1C,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAE5B,MAAI;AACF,UAAM,SAAS,MAAM,uBAAuB,GAAG,QAAQ,OAAO;AAC9D,QAAI,OAAO;AACT,YAAM,MAAM,aAAa,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO;AAAA,EACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,EACjC,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,MAAM,mBAAmB;AACpC,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,UAAU,EAAE,OAAO;AACrB,CAAC;AAED,MAAM,mCAAmC,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,UAAU,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO;AAAA,IAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAAA,QACtC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CustomEntity, CustomFieldDef } from '@open-mercato/core/modules/entities/data/entities'\nimport { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { isSystemEntitySelectable } from '@open-mercato/shared/lib/entities/system-entities'\nimport { SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, isOrmBackedSystemEntityId } from '@open-mercato/shared/lib/data/engine'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  beginEntitiesMutationGuard,\n  ENTITY_DEFINITION_RESOURCE_KIND,\n} from './definitions.mutation-guard'\n\nconst CUSTOM_ENTITY_DEFINITION_RESOURCE_KIND = ENTITY_DEFINITION_RESOURCE_KIND\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n\n  // Generated entities from code\n  const AllEntities = getEntityIds()\n  const generated: { entityId: string; source: 'code'; label: string }[] = []\n  for (const modId of Object.keys(AllEntities)) {\n    const entities = (AllEntities as any)[modId] as Record<string, string>\n    for (const k of Object.keys(entities)) {\n      const id = entities[k]\n      if (!isSystemEntitySelectable(id)) continue\n      generated.push({ entityId: id, source: 'code', label: id })\n    }\n  }\n\n  // Custom user-defined entities (global/org/tenant scoped)\n  const where: any = { isActive: true }\n  where.$and = [\n    { $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] },\n    { $or: [ { tenantId: auth.tenantId ?? undefined as any }, { tenantId: null } ] },\n  ]\n  const customs = await em.find(CustomEntity as any, where as any, { orderBy: { entityId: 'asc' } as any })\n  // Resolve overlay precedence: prefer organization/tenant-specific over global\n  const customByEntityId = new Map<string, any>()\n  for (const c of customs as any[]) {\n    const specificity = (c.organizationId ? 2 : 0) + (c.tenantId ? 1 : 0)\n    const prev = customByEntityId.get(c.entityId)\n    const prevSpec = prev ? ((prev.organizationId ? 2 : 0) + (prev.tenantId ? 1 : 0)) : -1\n    if (!prev || specificity > prevSpec) customByEntityId.set(c.entityId, c)\n  }\n\n  const custom = Array.from(customByEntityId.values())\n    .filter((c) => isSystemEntitySelectable(c.entityId))\n    .map((c) => ({\n      entityId: c.entityId,\n      source: 'custom' as const,\n      label: c.label,\n      description: c.description ?? undefined,\n      labelField: (c as any).labelField ?? undefined,\n      defaultEditor: (c as any).defaultEditor ?? undefined,\n      showInSidebar: (c as any).showInSidebar ?? false,\n      accessRestricted: (c as any).accessRestricted ?? false,\n      updatedAt: c.updatedAt instanceof Date ? c.updatedAt.toISOString() : (c.updatedAt ?? undefined),\n    }))\n\n  const byId = new Map<string, any>()\n  for (const g of generated) byId.set(g.entityId, g)\n  for (const cu of custom) {\n    const existing = byId.get(cu.entityId)\n    byId.set(cu.entityId, { ...existing, ...cu, source: existing?.source ?? cu.source })\n  }\n\n  // Count field definitions scoped to current tenant/org (same scoping as custom entities)\n  const defsWhere: any = { isActive: true }\n  defsWhere.$and = [\n    //{ $or: [ { organizationId: auth.orgId ?? undefined as any }, { organizationId: null } ] }, // the entities and custom fields are defined per tenant\n    { tenantId: auth.tenantId ?? undefined as any },\n  ]\n  const defs = await em.find(CustomFieldDef as any, defsWhere as any)\n  // Count distinct field names (keys) per entityId\n  const keySets = new Map<string, Set<string>>()\n  for (const d of defs as any[]) {\n    const eid = String(d.entityId)\n    const k = String(d.key)\n    if (!isSystemEntitySelectable(eid)) continue\n    const set = keySets.get(eid) || new Set<string>()\n    set.add(k)\n    keySets.set(eid, set)\n  }\n  const counts: Record<string, number> = {}\n  for (const [eid, set] of keySets.entries()) counts[eid] = set.size\n\n  const items = Array.from(byId.values()).map((it: any) => ({ ...it, count: counts[it.entityId] || 0 }))\n  return NextResponse.json({ items })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = upsertCustomEntitySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const input = parsed.data\n  // Distinguish \"caller did not send the field\" (apply tenant default-restricted\n  // policy on create) from \"caller explicitly chose false\".\n  const accessRestrictedExplicit = body != null && typeof body === 'object'\n    && Object.prototype.hasOwnProperty.call(body, 'accessRestricted')\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n\n  // A registration for a module-declared, table-backed system entity would flip\n  // query-engine classification to doc storage for the whole entity type (#2939's\n  // failure mode via another door) \u2014 refuse to create one.\n  if (isOrmBackedSystemEntityId(em, input.entityId)) {\n    return NextResponse.json(\n      { error: 'System entities cannot be registered as custom entities', code: SYSTEM_ENTITY_RECORDS_BLOCKED_CODE, entityId: input.entityId },\n      { status: 400 },\n    )\n  }\n\n  const where: any = { entityId: input.entityId, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }\n  let ent = await em.findOne(CustomEntity, where)\n  if (ent) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: CUSTOM_ENTITY_DEFINITION_RESOURCE_KIND,\n        resourceId: ent.id,\n        current: ent.updatedAt ?? null,\n        request: req,\n      })\n    } catch (lockError) {\n      if (isCrudHttpError(lockError)) {\n        return NextResponse.json(lockError.body, { status: lockError.status })\n      }\n      throw lockError\n    }\n  }\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: ENTITY_DEFINITION_RESOURCE_KIND,\n    resourceId: ent ? ent.id : input.entityId,\n    operation: ent ? 'update' : 'create',\n    mutationPayload: input as unknown as Record<string, unknown>,\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  const isCreate = !ent\n  if (!ent) ent = em.create(CustomEntity, { ...where, createdAt: new Date() })\n  ent.label = input.label\n  ent.description = input.description ?? null\n  ent.isActive = input.isActive ?? true\n  ent.labelField = input.labelField ?? ent.labelField ?? null\n  ent.defaultEditor = input.defaultEditor ?? ent.defaultEditor ?? null\n  ent.showInSidebar = input.showInSidebar ?? ent.showInSidebar ?? false\n  // Never silently flip a security control on a partial upsert. `access_restricted`\n  // changes ONLY when the caller explicitly sends the field. On create without it,\n  // fall back to the tenant default-restricted policy; on update without it, keep\n  // the entity's current value (a metadata-only update must not un-restrict).\n  if (accessRestrictedExplicit) {\n    ent.accessRestricted = input.accessRestricted === true\n  } else if (isCreate) {\n    let policyDefault = false\n    try {\n      const moduleConfigService = resolve('moduleConfigService') as {\n        getValue: (m: string, n: string, o?: { defaultValue?: unknown; scope?: { tenantId?: string | null } }) => Promise<unknown>\n      }\n      policyDefault = (await moduleConfigService.getValue('entities', 'newEntitiesRestrictedByDefault', {\n        defaultValue: false,\n        scope: { tenantId: auth.tenantId ?? null },\n      })) === true\n    } catch {}\n    ent.accessRestricted = policyDefault\n  } else {\n    ent.accessRestricted = ent.accessRestricted ?? false\n  }\n  ent.updatedAt = new Date()\n  em.persist(ent)\n  await em.flush()\n  await guard.runAfterSuccess()\n  // Invalidate sidebar/nav cache for tenant scope (also when tenantId is null)\n  try {\n    const cache = (await createRequestContainer()).resolve('cache') as any\n    if (cache) {\n      await cache.deleteByTags([`nav:entities:${auth.tenantId || 'null'}`])\n    }\n  } catch {}\n  return NextResponse.json({ ok: true, item: { id: ent.id, entityId: ent.entityId, label: ent.label, description: ent.description ?? undefined } })\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: any\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const entityId = body?.entityId\n  if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n\n  const where: any = { entityId, organizationId: auth.orgId ?? null, tenantId: auth.tenantId ?? null }\n  const ent = await em.findOne(CustomEntity, where)\n  if (!ent) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: ENTITY_DEFINITION_RESOURCE_KIND,\n    resourceId: ent.id,\n    operation: 'delete',\n    mutationPayload: { entityId },\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  ent.isActive = false\n  ent.updatedAt = new Date()\n  ent.deletedAt = ent.deletedAt ?? new Date()\n  em.persist(ent)\n  await em.flush()\n  await guard.runAfterSuccess()\n  // Invalidate sidebar/nav cache for tenant scope (also when tenantId is null)\n  try {\n    const cache = (await createRequestContainer()).resolve('cache') as any\n    if (cache) {\n      await cache.deleteByTags([`nav:entities:${auth.tenantId || 'null'}`])\n    }\n  } catch {}\n  return NextResponse.json({ ok: true })\n}\n\nconst entitySummarySchema = z.object({\n  entityId: z.string(),\n  source: z.enum(['code', 'custom']),\n  label: z.string(),\n  description: z.string().optional(),\n  labelField: z.string().optional(),\n  defaultEditor: z.string().optional(),\n  showInSidebar: z.boolean().optional(),\n  accessRestricted: z.boolean().optional(),\n  updatedAt: z.string().optional(),\n  count: z.number(),\n})\n\nconst entityListResponseSchema = z.object({\n  items: z.array(entitySummarySchema),\n})\n\nconst deleteEntityRequestSchema = z.object({\n  entityId: z.string(),\n})\n\nconst upsertCustomEntityResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string().uuid(),\n    entityId: z.string(),\n    label: z.string(),\n    description: z.string().optional(),\n  }),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Manage custom entities',\n  methods: {\n    GET: {\n      summary: 'List available entities',\n      description: 'Returns generated and custom entities scoped to the caller with field counts per entity.',\n      responses: [\n        {\n          status: 200,\n          description: 'List of entities',\n          schema: entityListResponseSchema,\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Upsert custom entity',\n      description: 'Creates or updates a tenant/org scoped custom entity definition.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: upsertCustomEntitySchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Entity saved',\n          schema: upsertCustomEntityResponseSchema,\n        },\n        {\n          status: 400,\n          description: 'Validation error',\n          schema: z.object({\n            error: z.string(),\n            details: z.any().optional(),\n          }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n    DELETE: {\n      summary: 'Soft delete custom entity',\n      description: 'Marks the specified custom entity inactive within the current scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: deleteEntityRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Entity deleted',\n          schema: z.object({ ok: z.boolean() }),\n        },\n        {\n          status: 400,\n          description: 'Missing entity id',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 401,\n          description: 'Missing authentication',\n          schema: z.object({ error: z.string() }),\n        },\n        {\n          status: 404,\n          description: 'Entity not found in scope',\n          schema: z.object({ error: z.string() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,cAAc,sBAAsB;AAC7C,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AAEzC,SAAS,gCAAgC;AACzC,SAAS,oCAAoC,iCAAiC;AAC9E,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,yCAAyC;AAExC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAAA,EAC5E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAChF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEvI,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AAGvB,QAAM,cAAc,aAAa;AACjC,QAAM,YAAmE,CAAC;AAC1E,aAAW,SAAS,OAAO,KAAK,WAAW,GAAG;AAC5C,UAAM,WAAY,YAAoB,KAAK;AAC3C,eAAW,KAAK,OAAO,KAAK,QAAQ,GAAG;AACrC,YAAM,KAAK,SAAS,CAAC;AACrB,UAAI,CAAC,yBAAyB,EAAE,EAAG;AACnC,gBAAU,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5D;AAAA,EACF;AAGA,QAAM,QAAa,EAAE,UAAU,KAAK;AACpC,QAAM,OAAO;AAAA,IACX,EAAE,KAAK,CAAE,EAAE,gBAAgB,KAAK,SAAS,OAAiB,GAAG,EAAE,gBAAgB,KAAK,CAAE,EAAE;AAAA,IACxF,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,YAAY,OAAiB,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,EACjF;AACA,QAAM,UAAU,MAAM,GAAG,KAAK,cAAqB,OAAc,EAAE,SAAS,EAAE,UAAU,MAAM,EAAS,CAAC;AAExG,QAAM,mBAAmB,oBAAI,IAAiB;AAC9C,aAAW,KAAK,SAAkB;AAChC,UAAM,eAAe,EAAE,iBAAiB,IAAI,MAAM,EAAE,WAAW,IAAI;AACnE,UAAM,OAAO,iBAAiB,IAAI,EAAE,QAAQ;AAC5C,UAAM,WAAW,QAAS,KAAK,iBAAiB,IAAI,MAAM,KAAK,WAAW,IAAI,KAAM;AACpF,QAAI,CAAC,QAAQ,cAAc,SAAU,kBAAiB,IAAI,EAAE,UAAU,CAAC;AAAA,EACzE;AAEA,QAAM,SAAS,MAAM,KAAK,iBAAiB,OAAO,CAAC,EAChD,OAAO,CAAC,MAAM,yBAAyB,EAAE,QAAQ,CAAC,EAClD,IAAI,CAAC,OAAO;AAAA,IACX,UAAU,EAAE;AAAA,IACZ,QAAQ;AAAA,IACR,OAAO,EAAE;AAAA,IACT,aAAa,EAAE,eAAe;AAAA,IAC9B,YAAa,EAAU,cAAc;AAAA,IACrC,eAAgB,EAAU,iBAAiB;AAAA,IAC3C,eAAgB,EAAU,iBAAiB;AAAA,IAC3C,kBAAmB,EAAU,oBAAoB;AAAA,IACjD,WAAW,EAAE,qBAAqB,OAAO,EAAE,UAAU,YAAY,IAAK,EAAE,aAAa;AAAA,EACvF,EAAE;AAEJ,QAAM,OAAO,oBAAI,IAAiB;AAClC,aAAW,KAAK,UAAW,MAAK,IAAI,EAAE,UAAU,CAAC;AACjD,aAAW,MAAM,QAAQ;AACvB,UAAM,WAAW,KAAK,IAAI,GAAG,QAAQ;AACrC,SAAK,IAAI,GAAG,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI,QAAQ,UAAU,UAAU,GAAG,OAAO,CAAC;AAAA,EACrF;AAGA,QAAM,YAAiB,EAAE,UAAU,KAAK;AACxC,YAAU,OAAO;AAAA;AAAA,IAEf,EAAE,UAAU,KAAK,YAAY,OAAiB;AAAA,EAChD;AACA,QAAM,OAAO,MAAM,GAAG,KAAK,gBAAuB,SAAgB;AAElE,QAAM,UAAU,oBAAI,IAAyB;AAC7C,aAAW,KAAK,MAAe;AAC7B,UAAM,MAAM,OAAO,EAAE,QAAQ;AAC7B,UAAM,IAAI,OAAO,EAAE,GAAG;AACtB,QAAI,CAAC,yBAAyB,GAAG,EAAG;AACpC,UAAM,MAAM,QAAQ,IAAI,GAAG,KAAK,oBAAI,IAAY;AAChD,QAAI,IAAI,CAAC;AACT,YAAQ,IAAI,KAAK,GAAG;AAAA,EACtB;AACA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,KAAK,GAAG,KAAK,QAAQ,QAAQ,EAAG,QAAO,GAAG,IAAI,IAAI;AAE9D,QAAM,QAAQ,MAAM,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,QAAa,EAAE,GAAG,IAAI,OAAO,OAAO,GAAG,QAAQ,KAAK,EAAE,EAAE;AACrG,SAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AACpC;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,QAAM,QAAQ,OAAO;AAGrB,QAAM,2BAA2B,QAAQ,QAAQ,OAAO,SAAS,YAC5D,OAAO,UAAU,eAAe,KAAK,MAAM,kBAAkB;AAElE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AAKvB,MAAI,0BAA0B,IAAI,MAAM,QAAQ,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,2DAA2D,MAAM,oCAAoC,UAAU,MAAM,SAAS;AAAA,MACvI,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,QAAa,EAAE,UAAU,MAAM,UAAU,gBAAgB,KAAK,SAAS,MAAM,UAAU,KAAK,YAAY,KAAK;AACnH,MAAI,MAAM,MAAM,GAAG,QAAQ,cAAc,KAAK;AAC9C,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,WAAW;AAClB,UAAI,gBAAgB,SAAS,GAAG;AAC9B,eAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,MACvE;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,MAAM,IAAI,KAAK,MAAM;AAAA,IACjC,WAAW,MAAM,WAAW;AAAA,IAC5B,iBAAiB;AAAA,EACnB,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,QAAM,WAAW,CAAC;AAClB,MAAI,CAAC,IAAK,OAAM,GAAG,OAAO,cAAc,EAAE,GAAG,OAAO,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC3E,MAAI,QAAQ,MAAM;AAClB,MAAI,cAAc,MAAM,eAAe;AACvC,MAAI,WAAW,MAAM,YAAY;AACjC,MAAI,aAAa,MAAM,cAAc,IAAI,cAAc;AACvD,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,iBAAiB;AAChE,MAAI,gBAAgB,MAAM,iBAAiB,IAAI,iBAAiB;AAKhE,MAAI,0BAA0B;AAC5B,QAAI,mBAAmB,MAAM,qBAAqB;AAAA,EACpD,WAAW,UAAU;AACnB,QAAI,gBAAgB;AACpB,QAAI;AACF,YAAM,sBAAsB,QAAQ,qBAAqB;AAGzD,sBAAiB,MAAM,oBAAoB,SAAS,YAAY,kCAAkC;AAAA,QAChG,cAAc;AAAA,QACd,OAAO,EAAE,UAAU,KAAK,YAAY,KAAK;AAAA,MAC3C,CAAC,MAAO;AAAA,IACV,QAAQ;AAAA,IAAC;AACT,QAAI,mBAAmB;AAAA,EACzB,OAAO;AACL,QAAI,mBAAmB,IAAI,oBAAoB;AAAA,EACjD;AACA,MAAI,YAAY,oBAAI,KAAK;AACzB,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAE5B,MAAI;AACF,UAAM,SAAS,MAAM,uBAAuB,GAAG,QAAQ,OAAO;AAC9D,QAAI,OAAO;AACT,YAAM,MAAM,aAAa,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,EAAE,IAAI,IAAI,IAAI,UAAU,IAAI,UAAU,OAAO,IAAI,OAAO,aAAa,IAAI,eAAe,OAAU,EAAE,CAAC;AAClJ;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,WAAW,MAAM;AACvB,MAAI,CAAC,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1F,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AAEvB,QAAM,QAAa,EAAE,UAAU,gBAAgB,KAAK,SAAS,MAAM,UAAU,KAAK,YAAY,KAAK;AACnG,QAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,KAAK;AAChD,MAAI,CAAC,IAAK,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE1E,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY,IAAI;AAAA,IAChB,WAAW;AAAA,IACX,iBAAiB,EAAE,SAAS;AAAA,EAC9B,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,MAAI,WAAW;AACf,MAAI,YAAY,oBAAI,KAAK;AACzB,MAAI,YAAY,IAAI,aAAa,oBAAI,KAAK;AAC1C,KAAG,QAAQ,GAAG;AACd,QAAM,GAAG,MAAM;AACf,QAAM,MAAM,gBAAgB;AAE5B,MAAI;AACF,UAAM,SAAS,MAAM,uBAAuB,GAAG,QAAQ,OAAO;AAC9D,QAAI,OAAO;AACT,YAAM,MAAM,aAAa,CAAC,gBAAgB,KAAK,YAAY,MAAM,EAAE,CAAC;AAAA,IACtE;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO;AAAA,EACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ,QAAQ,CAAC;AAAA,EACjC,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,kBAAkB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,MAAM,mBAAmB;AACpC,CAAC;AAED,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,UAAU,EAAE,OAAO;AACrB,CAAC;AAED,MAAM,mCAAmC,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,UAAU,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO;AAAA,IAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,CAAC;AACH,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,OAAO;AAAA,YAChB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAAA,QACtC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,QACxC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/api/entity-settings.js

@@ -0,0 +1,89 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+const CONFIG_MODULE = "entities";
+const NEW_ENTITIES_RESTRICTED_KEY = "newEntitiesRestrictedByDefault";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["entities.definitions.view"] },
+  PUT: { requireAuth: true, requireFeatures: ["entities.definitions.manage"] }
+};
+async function readPolicy(tenantId) {
+  try {
+    const { resolve } = await createRequestContainer();
+    const moduleConfigService = resolve("moduleConfigService");
+    const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
+      defaultValue: false,
+      scope: { tenantId }
+    });
+    return value === true;
+  } catch {
+    return false;
+  }
+}
+async function GET(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null);
+  return NextResponse.json({ newEntitiesRestrictedByDefault });
+}
+const putBodySchema = z.object({
+  newEntitiesRestrictedByDefault: z.boolean()
+});
+async function PUT(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth || !auth.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  let body;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
+  }
+  const parsed = putBodySchema.safeParse(body);
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation failed", details: parsed.error.flatten() }, { status: 400 });
+  }
+  const { resolve } = await createRequestContainer();
+  const moduleConfigService = resolve("moduleConfigService");
+  await moduleConfigService.setValue(
+    CONFIG_MODULE,
+    NEW_ENTITIES_RESTRICTED_KEY,
+    parsed.data.newEntitiesRestrictedByDefault,
+    { tenantId: auth.tenantId ?? null }
+  );
+  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault });
+}
+const settingsResponseSchema = z.object({
+  newEntitiesRestrictedByDefault: z.boolean()
+});
+const openApi = {
+  tag: "Entities",
+  summary: "Custom entity workspace settings",
+  methods: {
+    GET: {
+      summary: "Get custom entity settings",
+      description: "Returns the tenant-scoped default-restricted policy for new custom entities.",
+      responses: [
+        { status: 200, description: "Current settings", schema: settingsResponseSchema },
+        { status: 401, description: "Missing authentication", schema: z.object({ error: z.string() }) }
+      ]
+    },
+    PUT: {
+      summary: "Update custom entity settings",
+      description: "Sets the tenant-scoped default-restricted policy for new custom entities.",
+      requestBody: { schema: putBodySchema },
+      responses: [
+        { status: 200, description: "Updated settings", schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },
+        { status: 400, description: "Invalid payload", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Missing authentication", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=entity-settings.js.map

package/dist/modules/entities/api/entity-settings.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/entities/api/entity-settings.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\n// Tenant-scoped policy: when true, new custom entities are created with\n// `access_restricted = true` unless the create request explicitly sets the flag.\nconst CONFIG_MODULE = 'entities'\nconst NEW_ENTITIES_RESTRICTED_KEY = 'newEntitiesRestrictedByDefault'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\ntype ModuleConfigServiceLike = {\n  getValue: (\n    moduleId: string,\n    name: string,\n    options?: { defaultValue?: unknown; scope?: { tenantId?: string | null } },\n  ) => Promise<unknown>\n  setValue: (\n    moduleId: string,\n    name: string,\n    value: unknown,\n    scope?: { tenantId?: string | null },\n  ) => Promise<unknown>\n}\n\nasync function readPolicy(tenantId: string | null): Promise<boolean> {\n  try {\n    const { resolve } = await createRequestContainer()\n    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike\n    const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {\n      defaultValue: false,\n      scope: { tenantId },\n    })\n    return value === true\n  } catch {\n    return false\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null)\n  return NextResponse.json({ newEntitiesRestrictedByDefault })\n}\n\nconst putBodySchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n})\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: unknown\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = putBodySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike\n  await moduleConfigService.setValue(\n    CONFIG_MODULE,\n    NEW_ENTITIES_RESTRICTED_KEY,\n    parsed.data.newEntitiesRestrictedByDefault,\n    { tenantId: auth.tenantId ?? null },\n  )\n  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault })\n}\n\nconst settingsResponseSchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Custom entity workspace settings',\n  methods: {\n    GET: {\n      summary: 'Get custom entity settings',\n      description: 'Returns the tenant-scoped default-restricted policy for new custom entities.',\n      responses: [\n        { status: 200, description: 'Current settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update custom entity settings',\n      description: 'Sets the tenant-scoped default-restricted policy for new custom entities.',\n      requestBody: { schema: putBodySchema },\n      responses: [\n        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAKvC,MAAM,gBAAgB;AACtB,MAAM,8BAA8B;AAE7B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC7E;AAgBA,eAAe,WAAW,UAA2C;AACnE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,sBAAsB,QAAQ,qBAAqB;AACzD,UAAM,QAAQ,MAAM,oBAAoB,SAAS,eAAe,6BAA6B;AAAA,MAC3F,cAAc;AAAA,MACd,OAAO,EAAE,SAAS;AAAA,IACpB,CAAC;AACD,WAAO,UAAU;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,QAAM,iCAAiC,MAAM,WAAW,KAAK,YAAY,IAAI;AAC7E,SAAO,aAAa,KAAK,EAAE,+BAA+B,CAAC;AAC7D;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,sBAAsB,QAAQ,qBAAqB;AACzD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,YAAY,KAAK;AAAA,EACpC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,gCAAgC,OAAO,KAAK,+BAA+B,CAAC;AACnH;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE;AAAA,QACnI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/entities/api/records.js

@@ -13,36 +13,57 @@ import { getModules } from "@open-mercato/shared/lib/i18n/server";
 import { assertEntityAclForRequest } from "../lib/entityAcl.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("entities").child({ component: "records" });
-let declaredCustomEntityIds = null;
-function isDeclaredCustomEntity(entityId) {
-  if (declaredCustomEntityIds === null) {
+let declaredCustomEntityRestricted = null;
+function loadDeclaredCustomEntities() {
+  if (declaredCustomEntityRestricted === null) {
     try {
       const mods = getModules();
-      if (Array.isArray(mods) && mods.length) {
-        const ids = /* @__PURE__ */ new Set();
-        for (const mod of mods) {
-          for (const spec of mod?.customEntities ?? []) {
-            if (spec?.id) ids.add(spec.id);
-          }
+      const map = /* @__PURE__ */ new Map();
+      for (const mod of mods ?? []) {
+        for (const spec of mod?.customEntities ?? []) {
+          if (spec?.id) map.set(spec.id, spec.accessRestricted === true);
         }
-        declaredCustomEntityIds = ids;
       }
+      declaredCustomEntityRestricted = map;
     } catch {
     }
   }
-  return declaredCustomEntityIds?.has(entityId) ?? false;
+  return declaredCustomEntityRestricted ?? /* @__PURE__ */ new Map();
+}
+function isDeclaredCustomEntity(entityId) {
+  return loadDeclaredCustomEntities().has(entityId);
+}
+async function findScopedCustomEntity(em, CustomEntity, entityId, scope) {
+  const { tenantId, organizationId } = scope;
+  const candidates = [
+    { entityId, organizationId, tenantId },
+    { entityId, organizationId: null, tenantId },
+    { entityId, organizationId: null, tenantId: null }
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const where of candidates) {
+    const key = JSON.stringify(where);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const row = await em.findOne(CustomEntity, where);
+    if (row) return row;
+  }
+  return null;
 }
 const CUSTOM_ENTITY_RECORD_RESOURCE_KIND = "entities.record";
-async function classifyRecordsEntity(em, entityId) {
-  if (isOrmBackedSystemEntityId(em, entityId)) return "system";
-  if (isDeclaredCustomEntity(entityId)) return "custom";
+async function classifyRecordsEntity(em, entityId, scope) {
+  if (isOrmBackedSystemEntityId(em, entityId)) return { kind: "system", restricted: false };
+  const declared = loadDeclaredCustomEntities();
+  if (declared.has(entityId)) return { kind: "custom", restricted: declared.get(entityId) === true };
   try {
     const { CustomEntity } = await import("../data/entities.js");
-    const found = await em.findOne(CustomEntity, { entityId });
-    if (found) return "custom";
+    const scoped = await findScopedCustomEntity(em, CustomEntity, entityId, scope);
+    if (scoped) return { kind: "custom", restricted: scoped.accessRestricted === true };
+    const anyRow = await em.findOne(CustomEntity, { entityId });
+    if (anyRow) return { kind: "custom", restricted: false };
   } catch {
   }
-  return "unknown";
+  return { kind: "unknown", restricted: false };
 }
 function systemEntityRecordsRejection(entityId) {
   return NextResponse.json(
@@ -125,10 +146,10 @@ async function GET(req) {
     const rbac = resolve("rbacService");
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) });
     let organizationIds = scope.filterIds;
-    const entityKind = await classifyRecordsEntity(em, entityId);
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null });
     if (entityKind === "system") return systemEntityRecordsRejection(entityId);
     const isCustomEntity = entityKind === "custom";
-    await assertEntityAclForRequest({ auth, entityId, action: "view", isCustomEntity, rbac });
+    await assertEntityAclForRequest({ auth, entityId, action: "view", isCustomEntity, isRestricted, rbac });
     if (organizationIds && organizationIds.length === 0) {
       return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 0 });
     }
@@ -324,10 +345,10 @@ async function POST(req) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) });
     const targetOrgId = scope.selectedId ?? auth.orgId;
     if (!targetOrgId) return NextResponse.json({ error: "Organization context is required" }, { status: 400 });
-    const entityKind = await classifyRecordsEntity(em, entityId);
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null });
     if (entityKind === "system") return systemEntityRecordsRejection(entityId);
     const isCustomEntity = entityKind === "custom";
-    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, rbac });
+    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, isRestricted, rbac });
     for (const reservedKey of ["id", "created_at", "createdAt", "updated_at", "updatedAt", "deleted_at", "deletedAt"]) {
       delete values[reservedKey];
     }
@@ -389,10 +410,10 @@ async function PUT(req) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) });
     const targetOrgId = scope.selectedId ?? auth.orgId;
     if (!targetOrgId) return NextResponse.json({ error: "Organization context is required" }, { status: 400 });
-    const entityKind = await classifyRecordsEntity(em, entityId);
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null });
     if (entityKind === "system") return systemEntityRecordsRejection(entityId);
     const isCustomEntity = entityKind === "custom";
-    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, rbac });
+    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, isRestricted, rbac });
     for (const reservedKey of ["id", "created_at", "createdAt", "updated_at", "updatedAt", "deleted_at", "deletedAt"]) {
       delete values[reservedKey];
     }
@@ -479,10 +500,10 @@ async function DELETE(req) {
     const scope = await resolveOrganizationScope({ em, rbac, auth, selectedId: getSelectedOrganizationFromRequest(req) });
     const targetOrgId = scope.selectedId ?? auth.orgId;
     if (!targetOrgId) return NextResponse.json({ error: "Organization context is required" }, { status: 400 });
-    const entityKind = await classifyRecordsEntity(em, entityId);
+    const { kind: entityKind, restricted: isRestricted } = await classifyRecordsEntity(em, entityId, { tenantId: auth.tenantId ?? null, organizationId: scope.selectedId ?? auth.orgId ?? null });
     if (entityKind === "system") return systemEntityRecordsRejection(entityId);
     const isCustomEntity = entityKind === "custom";
-    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, rbac });
+    await assertEntityAclForRequest({ auth, entityId, action: "manage", isCustomEntity, isRestricted, rbac });
     try {
       const currentUpdatedAt = await readCustomEntityRecordUpdatedAt(em, {
         entityType: entityId,